The organization is required to demonstrate their compliance with cybersecurity risk management obligations. Upon receiving a request from the cybersecurity authority, the organization must submit a self-declaration that lists all implemented risk management measures in accordance with Section 32 of the national cybersecurity law. This declaration must follow a structured format defined by the authority and be submitted within six months of the request. The purpose of the self-declaration is to provide transparency and assurance that the organization has taken appropriate technical, operational, and organizational measures to manage cybersecurity risks.