Requirement
In addition to Subcontrols in the ECC control 2-3-3, the CST shall cover the following additional Subcontrols for cybersecurity requirements for information system and processing facilities protection requirements, as a minimum:
Sub-Controls
2-3-T-1-1
Requirement: Verifying that the CSP isolates the community cloud services provided to CSTs (government entities and CNI entities) from any other cloud computing provided to entities outside the scope of work.
References
- ECC – 2:2024 equivalent: 2-3-3
