10.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall ensure that their employees and direct suppliers and service providers, wherever applicable, understand, demonstrate and commit to their security responsibilities, as appropriate for the offered services and the job and in line with the relevant entities’ policy on
10.2.1. The relevant entities shall perform background checks for their employees, direct suppliers and service providers, if required for their role, responsibilities and authorisations. 10.2.2. For the purpose of point 10.2.1., the relevant entities shall: (a) put in place criteria, which set out which roles, responsibilities and authorities shall only be exercised by persons who
10.3.1. The relevant entities shall ensure that network and information system security responsibilities and duties that remain valid after termination or change of employment of their employees are set out, enforced, communicated and understood. 10.3.2. For the purpose of point 10.3.1., the relevant entities shall: (a) include in the individual’s terms and conditions of employment,
10.4.1. The relevant entities shall establish, communicate and maintain a disciplinary process for handling violations of network and information system security policies. The process shall take into consideration relevant legal, statutory, contractual and business requirements. 10.4.2. The relevant entities shall review and, where appropriate, update the disciplinary process at planned intervals, and when necessary due