Requirement
In addition to the subcontrols in ECC control 2-7-3, cybersecurity requirements for protecting and handling data and information must include at least the following:
Sub-Controls
2-6-1-1
Requirement: Prohibting the use of critical systems' data in any environment other than production environment, except after applying strict controls for protecting that data, such as: data masking or data scrambling techniques.
2-6-1-2
Requirement: Classifying all data within critical systems.
2-6-1-3
Requirement: Protecting classified data of critical systems using data leakage prevention techniques.
2-6-1-4
Requirement: Identifying retention period for critical systems-associated data, in accordance with relevant legislations. Only required data must be retained in critical systems' production environments.
2-6-1-5
Requirement: Prohibting the transfer of any critical systems' data from production environment to any other environment.
References
- ECC – 2:2024 equivalent: 2-7-3
