# Commission Regulation (EU) 2018/1798 of 21 November 2018 implementing Regulation (EC) No 808/2004 of the European Parliament and of the Council concerning Community statistics on the information society for the reference year 2019 (Text with EEA relevance) (revoked), Division (g): ICT security

Extent: E+W+S+N.I.
Status: repealed

(i)for enterprises with computers:
use as an ICT security measure: strong password authentication;
use as an ICT security measure: keeping the software (including operating systems) up-to-date;
use as an ICT security measure: user identification and authentication via biometric methods implemented by the enterprise;
use as an ICT security measure: encryption techniques for data, documents or e-mails;
use as an ICT security measure: data backup to a separate location (including backup to the cloud);
use as an ICT security measure: network access control (management of access by devices and users to the enterprise's network);
use as an ICT security measure: VPN (Virtual Private Network, which extends the private network across a public network to enable secure exchange of data over public network);
use as an ICT security measure: maintaining log files for analysis after security incidents;
use as an ICT security measure: ICT risk assessment, i.e. periodically assessment of probability and consequences of ICT security incidents;
use as an ICT security measure: ICT security tests such as performing penetration tests, testing security alert systems, reviewing security measures, testing backup systems;
making persons employed aware of their obligations in ICT security related issues through voluntary training or internally available information (such as information on the intranet);
making persons employed aware of their obligations in ICT security related issues through compulsory training courses or viewing compulsory material;
making persons employed aware of their obligations in ICT security related issues through a contract (such as a contract of employment);
ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by enterprise's own employees (including those employed in parent or affiliate enterprises);
ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by external suppliers;
availability of document(s) on measures, practices or procedures on ICT security;
problems experienced at least once in the previous calendar year due to ICT related incidents: unavailability of ICT services, for example denial of service attacks, ransomware attacks, hardware or software failures excluding mechanical failure, theft;
problems experienced at least once in the previous calendar year due to ICT related incidents: destruction or corruption of data, for example due to infection of malicious software or unauthorised intrusion, hardware or software failures;
problems experienced at least once in the previous calendar year due to ICT related incidents: disclosure of confidential data, for example due to intrusion, pharming, phishing attack, actions by enterprise's own employees (intentionally or unintentionally);
availability of an insurance against ICT security incidents;
(ii)for enterprises having document(s) on measures, practices or procedures on ICT security:
(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: management of access rights for the usage of ICT, such as computers, network;
(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: storage, protection, access or processing of data;
(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: procedures or rules to prevent or respond to security incidents, such as pharming, phishing attacks, ransomware;
(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: responsibility, rights and duties of persons employed in the field of ICT, such as use of e-mails, mobile devices, social media;
(optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: training of persons employed in the safe usage of ICT;
most recent definition or review of enterprise's document(s) on measures, practices or procedures on ICT security (such as risk assessment, evaluation of ICT security incidents): within the last 12 months; more than 12 months and up to twenty-four months ago; more than twenty-four months ago.

---
Source: https://www.legislation.gov.uk/eur/2018/1798/annex/I/division/A/division/2/division/g (the official version)
Page: https://openlegislation.uk/eu-regulation-2018-1798/annex-I/division-A/division-2/division-g
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.