Requirement
In addition to the subcontrols in ECC control 2-3-3, cybersecurity requirements for protecting critical systems and information processing facilities must include at least the following:
Sub-Controls
2-3-1-1
Requirement: Whitelisting of application and software operation files that are allowed to execute on servers hosting critical systems.
2-3-1-2
Requirement: Protecting servers hosting critical systems using end-point protection solutions that are approved by the organization.
2-3-1-3
Requirement: Applying security patches and updates at least once every month for external and internet-connected critical systems and at least once every three months for internal critical systems, in line with the organization's approved change managmenet mechanisms.
2-3-1-4
Requirement: Allocating specific workstations in an isolated network (Management Network), that is isolated from other networks or services (e.g., email service or internet), to be used by highly privileged accounts.
2-3-1-5
Requirement: Encrypting the network traffic of non-console administrative access for all technical components of critical systems using secure encryption algorithms and protocols.
2-3-1-6
Requirement: Reviewing critical systems' configurations and hardening at least once every six months.
2-3-1-7
Requirement: Reviewing and changing default configurations, and ensuring the removal of hard-coded, backdoor and/or default passwords, where applicable.
2-3-1-8
Requirement: Protecting systems' logs and critical files from unauthorized access, tampering, illegitimate modification and/or deletion.
References
- ECC – 2:2024 equivalent: 2-3-3
