For the purpose of point 2.1.1, the relevant entities shall establish procedures for identification, analysis, assessment and treatment of risks (‘cybersecurity risk management process’). The cybersecurity risk management process shall be an integral part of the relevant entities’ overall risk management process, where applicable. As part of the cybersecurity risk management process, the relevant entities shall:

1. follow a risk management methodology;
2. establish the risk tolerance level in accordance with the risk appetite of the relevant entities;
3. establish and maintain relevant risk criteria;
4. in line with an all-hazards approach, identify and document the risks posed to the security of network and information systems, in particular in relation to third parties and risks that could lead to disruptions in the availability, integrity, authenticity and confidentiality of the network and information systems, including the identification of single point of failures;
5. analyse the risks posed to the security of network and information systems, including threat, likelihood, impact, and risk level, taking into account cyber threat intelligence and vulnerabilities;
6. evaluate the identified risks based on the risk criteria;
7. identify and prioritise appropriate risk treatment options and measures;
8. continuously monitor the implementation of the risk treatment measures;
9. identify who is responsible for implementing the risk treatment measures and when they should be implemented;
10. document the chosen risk treatment measures in a risk treatment plan and the reasons justifying the acceptance of residual risks in a comprehensible manner.