Practical application · Annex IV
Public entities
Annex IV lays down mandatory measures for relevant public entities organized by groups A and B.
Framework
To whom it applies.
Relevant public entities qualified under the RJCS and the Regulation.
Simple Reading
Five essential points.
- Distinguishing group measures A and B
- Group A also includes Group B measures
- Organize requirements by operational areas
- Associates measures with verification criteria
- Privilege demonstrable capacity and continuous monitoring
Start without complicating
Four practical steps.
- 01
Confirm group
record the notified qualification and the organizational scope covered.
- 02
Gathering the measures
Create a single list; in Group A, also include all measures of Group B.
- 03
Associate responsible
Assign each measure to a function and identify the expected evidence.
- 04
Run and review
Treat gaps, test the application and keep evidence up to date.
Proof
Which should be organized.
- Notification or registration of the applicable group
- Matrix of measures A and/or B
- Designations, policies and procedures
- Operational, technical and review registers
Warning
Avoid wrong readings.
- Do not apply to the public sector the tier matrix of Annex III without confirming the framework.
- Do not treat Group A as an alternative to Group B.
- Do not limit conformity to initial production of documents.
Frequently Asked Questions
Two straight answers.
Does Group A include Group B?
Yes. Relevant public entities subject to the Group A shall also ensure the minimum measures defined for Group B.
Do these entities use Basic, Substantial and High Levels?
Annex IV establishes for the relevant public bodies a group organization of its own A and B. The notified qualification must always be confirmed.
Primary source
Regulation No. 756/2026 of 22 June
Information guide and simplified. To apply a measure or interpret a criterion, always confirm the full text of the official act.