Article 31.1—Article 31.1
>Control Description
The information systems included in the scope of application of this royal decree will be subject to a regular audit, at least every two years, to verify compliance with the requirements of the ENS.
On an extraordinary basis, said audit must be carried out whenever substantial changes occur in the information systems, which may impact the required security measures. The completion of the extraordinary audit will determine the calculation date for the calculation of the two years, established for the completion of the next regular ordinary audit, indicated in the previous paragraph.
The two-year period indicated in the previous paragraphs may be extended for three months when force majeure impediments occur that are not attributable to the entity that owns the information system or systems concerned.
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.