The organization must formally adopt, document, and implement a comprehensive set of security measures based on the findings from its continuous monitoring process. There must be a clear procedure for translating the requirements from external standards and good practices into the organization's internal security policies, procedures, and technical controls.

The organization must establish a formal process to continuously monitor for and analyze external security guidance and developments.

This process must include the regular review of

• Security methodologies and policies published by the national Authority
• The latest security trends, threat intelligence, and technological advancements
• Examples of industry-recognized good practices
• Relevant international standards