Many thanks for this document which brings clarification for both competent authorities and organizations on the deliverables needed to be compliant on the applicability date. Still I have a question of consistency regarding a particular point. The expectation is for organizations to demonstrate we are at the "present & suitable" level. On page 7, expectation #4 is "The organisation has performed an initial risk assessment (e.g. major risks and related threat
scenarios both internal and at the interfaces).". To perform the initial risk assessment as described, organisations must have an Information Security Risk Assessment process not only present and suitable but fully operating and effective. Could you please provide your view on this point?