GV013Periodic program review

The revision of each component of the program at a stated interval.

Pillar: GV | Governance and mandate
Sources cited: 6
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
GV013/GRMandatory	Greece	Νόμος 5160/2024, άρθρα 8, 14, 15, and 16Βουλή των Ελλήνων · read 5 Oct 2026	For essential and important entities, that the Εθνική Αρχή Κυβερνοασφάλειας is the competent authority and single point of contact, that the management bodies approve the risk management measures within three months of the Act’s entry into force, supervise their implementation, and are responsible for breaches, that their members follow training and the entity gives employees similar training at least annually, that the measures include incident handling, cyber hygiene and training, human resources security, access control policies, and asset management, and multi-factor or continuous authentication, that the entity designates a Υπεύθυνος Ασφάλειας Συστημάτων Πληροφορικής και Επικοινωνιών (Υ.Α.Σ.Π.Ε.) whose duties are incompatible with the Data Protection Officer’s, keeps a single cybersecurity policy and an inventory of assets ranked by criticality, and that a significant incident is reported in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, policies and procedures assess the effectiveness of the risk management measures, and the single cybersecurity policy of an essential entity goes to the Εθνική Αρχή Κυβερνοασφάλειας for approval of its completeness at least annually.
GV013/HUMandatory	Hungary	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For organizations in scope, the head of the organization ensures the periodic evaluation of the protective measures, by risk analyses, checks, and an internal cybersecurity evaluation on the authority’s recommendation, remedies the deficiencies found, and reviews the security classification at least every two years or without delay on a change affecting security.
GV013/NOMandatory	Norway	Arbeidsmiljøloven, sections 9-1 and 9-2Storting · read 29 Aug 2026	That a control measure needs objective grounds in the undertaking and must not be a disproportionate burden, and that it is discussed with the elected representatives, notified with its expected duration, and evaluated with them at intervals.	The need for the measures is evaluated at intervals, and the evaluation is made together with the elected representatives rather than by the employer alone.
GV013/ROMandatory	Romania	Ordonanța de urgență nr. 155/2024, articolele 11 la 15Guvernul României · read 5 Oct 2026	For essential and important entities, that the measures include the logging and traceability of all activities in the networks and information systems, human resources security, access control policies and asset management, and incident handling; that the management bodies approve the measures, supervise them, and answer for breaches, follow accredited training and ensure training of all personnel; that an annual self-assessment of maturity goes to the DNSC; and that a significant incident is notified in an early warning within 24 hours, a notification within 72 hours, and a final report within one month.	For essential and important entities, an annual self-assessment of the maturity of the risk management measures, assumed by management, goes to the DNSC and, where applicable, to the sectoral authority; essential entities send a remediation plan within 30 days of it.
Recommended	United Kingdomwhere written	Insider Risk Mitigation FrameworkNPSA · read 11 Aug 2026	A structure for an insider risk management program that an organization reviews itself against, with governance and culture as foundations rather than adjuncts.	The framework is offered as something an organization reviews itself against, which makes the review a recurring act rather than a one-off inspection.
Reported	United Kingdomwhere written	Systematic analysis of security advice on the topic of insider threatsStewart and Hobbs · read 11 Aug 2026	What the published guidance on insider threat actually instructs a reader to do, the advice literature being the object of study.	The advice literature has itself been coded and characterised, so what guidance instructs can be examined rather than assumed.