OSSEC

DE.AE-02: Potentially adverse events are analyzed to better understand associated activities

DE.AE-06: Information on adverse events is provided to authorized staff and tools

Does the assessment also include the adequacy of the existing controls in the context of the identified risks or threats you face; and Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the IS program will address the risks?

Is your risk assessment written and does it include criteria for the evaluation and categorization of identified security risks, criteria for the assessment of the confidentiality, integrity, and availability of your IS and customer information,

Requires regular, secure backups and recovery processes.

Expands the Solvency II framework to address digital resilience in insurance.

Establish and Maintain an Incident Response Process