Requirement
In addition to the subcontrols in ECC control 2-5-3, cybersecurity requirements of critical systems' network security management must include at least the following:
Sub-Controls
2-4-1-1
Requirement: Logically and/or physically segregating and isolating critical systems' networks.
2-4-1-2
Requirement: Reviewing firewall rules and access lists, at least once every six months.
2-4-1-3
Requirement: Prohibiting direct connection between local network devices and critical systems, unless those devices are scanned to ensure they have security controls that meet the acceptable security levels for critical systems.
2-4-1-4
Requirement: Prohibiting critical systems from connecting to a wireless network.
2-4-1-5
Requirement: Protecting against Advanced Persistent Threats (APT) at the network layer.
2-4-1-6
Requirement: Prohibiting connection to the internet for critical systems that provide internal services to the organization and have no strong need to be accessed from outside the organization.
2-4-1-7
Requirement: Critical systems that provide services to a limited number of organizations (not individuals), shall use networks isolated from the Internet.
2-4-1-8
Requirement: Protecting against Distributed Denial of Service (DDoS) attacks to limit risks arising from these attacks.
2-4-1-9
Requirement: Allowing only whitelisting for critical systems' firewall access lists.
References
- ECC – 2:2024 equivalent: 2-5-3
