2.2.3 Establish a national register of risks, regulations and directives to promote evaluating and managing risks ADIE; June 2018 CERT/CSIRT National directory of risks, regulations and directives 2.2.4 Create a log of cyber-incidents, update it constantly, evaluate incidents and propose solutions ADIE; Cyber-incident log September 2018 2.2.5 Implement data protection and risk management procedures CERT/CSIRT 2.2.6 Design and implement cybersecurity incident scenarios and simulation programmes to be used in national exercises CERT/CSIRT CERT/CSIRT How often is national risk directory updated? ADIE; How often are national risk and incident logs updated? ADIE; 25,000,000 National cybersecurity structure 25,000,000 CERT/CSIRT How often are measures to mitigate threats and risks and resolve them developed and applied? Data protection and management procedures September 2018 Cyber incident scenarios and simulation programmes December 2018 How far are data protection and management procedures being applied? ADIE; Are cyber incident scenarios and simulation programmes being used in exercises on a national scale? National cybersecurity structure 25,000,000 National cybersecurity structure 25,000,000 36