What this means in practice
Translate the provision into accountable decisions and documented processes. The exact application depends on the entity, the relevant national law and any applicable sector-specific rules.
Implementation questions
- Define the systems and services in scope
- Record risk decisions and accountable owners
- Review measures against Article 21 and national requirements
Evidence to organise
| Record | What to check |
|---|---|
| Approved risk methodology | Owner, currency, approval and follow-up actions |
| Control inventory and policy owners | Owner, currency, approval and follow-up actions |
| Review and exception records | Owner, currency, approval and follow-up actions |
These are planning prompts, not an exhaustive legal checklist or proof of compliance.
Official sources and context
Use these alongside the applicable national legislation and authority guidance. This page is general information and may not reflect every national measure or later amendment.