Entities need a testing programme that covers vulnerability scans, scenario tests and other checks on critical systems. Testing must be risk based and done by independent parties, internal or external. Findings must be tracked to closure.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Set up a yearly testing plan for critical systems
- Include scenario based and recovery tests
- Track every finding to a fix and a date
Next steps
Testing is only useful if the results lead to change. Report open findings to management. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.