Requirement
The cybersecurity requirements for critical systems' internal applications must include at least the following:
Sub-Controls
2-13-3-1
Requirement: Adopting multi-tier architecture principle, provided that number of tiers is not less than three.
2-13-3-2
Requirement: Using secure protocols (e.g., HTTPS).
2-13-3-3
Requirement: Outlining the acceptable use policy for users.
2-13-3-4
Requirement: Secure session management, including session authenticity, session lockout and session timeout.
