12.1.1. For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall lay down classification levels of all information and assets in scope of their network and information systems for the level of protection required. 12.1.2. For the purpose of point 12.1.1., the relevant entities shall: (a) lay down a
12.2.1. The relevant entities shall establish, implement and apply a policy for the proper handling of information and assets in accordance with their network and information security policy, and shall communicate the policy to anyone who uses or handles information and assets. 12.2.2. The policy shall: (a) cover the entire life cycle of the information
12.3.1. The relevant entities shall establish, implement and apply a policy on the management of removable storage media and communicate it to their employees and third parties who handle removable storage media at the relevant entities’ premises or other locations where the removable media is connected to the relevant entities’ network and information systems. 12.3.2.
The relevant entities shall establish, implement and apply procedures which ensure that their assets which are under custody of personnel are returned upon termination of employment, and shall document the deposit and return of those assets.
12.4.1. The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent inventory of their assets. They shall record changes to the entries in the inventory in a traceable manner. 12.4.2. The granularity of the inventory of the assets shall be at a level appropriate for the needs of the relevant entities. The