What it asks for. Point (a) requires entities to have policies on risk analysis and on the security of information systems. These policies form the foundation for the other risk management measures in Article 21.
In practice. The entity has an approved information security policy and a documented risk assessment method covering how risks are identified, analysed, evaluated and treated. Risk assessments are performed regularly and after significant changes, with results driving a treatment plan approved by management. Evidence includes the policy set, the risk methodology, recent assessments and the risk register.
Common gaps. Policies are often generic templates not reflecting how the organisation actually works. Risk assessments may be outdated or disconnected from operational and investment decisions.