S.L. 460.24 Art. 7ECI OSP Procedure.

(1) The ECI OSP procedure referred to in article 6 shall cover at least the following matters:

(a) the identification of important assets;

(b) the conduct of a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact; and

(c) the identification, selection and prioritisation of counter-measures and procedures with a distinction between -

(i) permanent security measures, which identify indispensable security investments and means which are relevant to be employed at all times. These shall include the information set out in sub-article (2); and

(ii) graduated security measures, which can be activated according to varying risk and threat levels.

(2) The information referred to in sub-article (1)(c)(i) is information concerning:

(a) general measures such as technical measures, including installation of detection, access control, protection and prevention means;

(b) organisational measures, including procedures for alerts and crisis management;

(c) control and verification measures;

(d) communication;

(e) awareness raising and training; and

(f) security of information systems. (IDENTIFICATION, DESIGNATION AND PROTECTION)