Requirement
In addition to Subcontrols in the ECC control 2-3-3, the CSP shall cover the following additional Subcontrols for cybersecurity requirements for information system and processing facilities protection requirements, as a minimum:
Sub-Controls
2-3-P-1-1
Requirement: Ensuring that all configurations are applied in accordance with CSP's cybersecurity standards.
2-3-P-1-2
Requirement: Assurance of separation and isolation of data, environments, and information systems across CSTs, to prevent data commingling.
2-3-P-1-3
Requirement: Adopting cybersecurity principles for technical system configurations adhering to the minimum functionality principle.
2-3-P-1-4
Requirement: Ability of the Cloud Technology Stacks to securely handle input validation, exceptions and failure.
2-3-P-1-5
Requirement: Full isolation of security functions and applications from other functions and applications in the Cloud Technology Stack.
2-3-P-1-6
Requirement: Notification to CSTs with cybersecurity requirements provided by the CSP that are useable by the CST.
2-3-P-1-7
Requirement: Detection and prevention of unauthorized changes to software programs, and systems.
2-3-P-1-8
Requirement: Complete isolation and protection of multiple guest environments.
2-3-P-1-9
Requirement: The community cloud services provided to CSTs (government entities and CNI entities) shall be isolated from any other cloud computing provided to entities outside the scope of work.
2-3-P-1-10
Requirement: Modern technologies, such as Endpoint Detection and Response (EDR) technologies, to ensure that the information servers and devices of CSP's information processing systems and devices of are ready for rapid response to incidents.
References
- ECC – 2:2024 equivalent: 2-3-3
