{
  "url": "https://openlegislation.uk/eu-regulation-2018-1798/annex-I/division-A/division-2/division-g",
  "json_url": "https://openlegislation.uk/eu-regulation-2018-1798/annex-I/division-A/division-2/division-g.json",
  "legislation": "eur/2018/1798",
  "legislation_title": "Commission Regulation (EU) 2018/1798 of 21 November 2018 implementing Regulation (EC) No 808/2004 of the European Parliament and of the Council concerning Community statistics on the information society for the reference year 2019 (Text with EEA relevance) (revoked)",
  "legislation_url": "https://openlegislation.uk/eu-regulation-2018-1798",
  "path": "annex/I/division/A/division/2/division/g",
  "kind": "division",
  "number": "(g)",
  "heading": "ICT security",
  "text": "(i)for enterprises with computers:\nuse as an ICT security measure: strong password authentication;\nuse as an ICT security measure: keeping the software (including operating systems) up-to-date;\nuse as an ICT security measure: user identification and authentication via biometric methods implemented by the enterprise;\nuse as an ICT security measure: encryption techniques for data, documents or e-mails;\nuse as an ICT security measure: data backup to a separate location (including backup to the cloud);\nuse as an ICT security measure: network access control (management of access by devices and users to the enterprise's network);\nuse as an ICT security measure: VPN (Virtual Private Network, which extends the private network across a public network to enable secure exchange of data over public network);\nuse as an ICT security measure: maintaining log files for analysis after security incidents;\nuse as an ICT security measure: ICT risk assessment, i.e. periodically assessment of probability and consequences of ICT security incidents;\nuse as an ICT security measure: ICT security tests such as performing penetration tests, testing security alert systems, reviewing security measures, testing backup systems;\nmaking persons employed aware of their obligations in ICT security related issues through voluntary training or internally available information (such as information on the intranet);\nmaking persons employed aware of their obligations in ICT security related issues through compulsory training courses or viewing compulsory material;\nmaking persons employed aware of their obligations in ICT security related issues through a contract (such as a contract of employment);\nICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by enterprise's own employees (including those employed in parent or affiliate enterprises);\nICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by external suppliers;\navailability of document(s) on measures, practices or procedures on ICT security;\nproblems experienced at least once in the previous calendar year due to ICT related incidents: unavailability of ICT services, for example denial of service attacks, ransomware attacks, hardware or software failures excluding mechanical failure, theft;\nproblems experienced at least once in the previous calendar year due to ICT related incidents: destruction or corruption of data, for example due to infection of malicious software or unauthorised intrusion, hardware or software failures;\nproblems experienced at least once in the previous calendar year due to ICT related incidents: disclosure of confidential data, for example due to intrusion, pharming, phishing attack, actions by enterprise's own employees (intentionally or unintentionally);\navailability of an insurance against ICT security incidents;\n(ii)for enterprises having document(s) on measures, practices or procedures on ICT security:\n(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: management of access rights for the usage of ICT, such as computers, network;\n(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: storage, protection, access or processing of data;\n(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: procedures or rules to prevent or respond to security incidents, such as pharming, phishing attacks, ransomware;\n(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: responsibility, rights and duties of persons employed in the field of ICT, such as use of e-mails, mobile devices, social media;\n(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: training of persons employed in the safe usage of ICT;\nmost recent definition or review of enterprise's document(s) on measures, practices or procedures on ICT security (such as risk assessment, evaluation of ICT security incidents): within the last 12 months; more than 12 months and up to twenty-four months ago; more than twenty-four months ago.",
  "extent": "E+W+S+N.I.",
  "status": "repealed",
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Regulation revoked (15.12.2021) by The UK Statistics (Amendment etc.) (EU Exit) Regulations 2021 (S.I. 2021/1300), reg. 1, Sch. 1 para. 97"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eur/2018/1798/annex/I/division/A/division/2/division/g",
    "retrieved_at": "2026-11-01T14:43:49.097710+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}