Spain ENS Art. 14: Manage risk with a recognised methodology and justify measures proportionately

What does Art. 14 require?

Articles 14 to 27: each organisation manages its own risks through analysis and treatment using an internationally recognised methodology, with measures justified and proportionate; staff are trained, informed and supervised; security is run by qualified personnel across the lifecycle and providers of security services must have qualified staff and mature management; access is limited to authorised users and functions; facilities are controlled; certified security products and services are used in proportion to category (as the CCN certification body determines); systems follow least privilege and secure configuration guides; changes to assets need prior authorisation with continuous vulnerability monitoring; stored and transmitted information, including paper, is protected; the perimeter and interconnections are controlled; user activity is logged within data protection limits; incidents are managed; backups and continuity exist; and the process is continually improved.