Requirement
With reference to ECC control 1-8-2, cybersecurity review and audit must be conducted periodically by independent parties outside the organization's cybersecurity function as specified for each data classification level. Required frequency by data classification level. Public: At least every 2 years. Confidential: At least every 2 years. Secret: At least annually. Top Secret: At least annually.
References
- ECC – 2:2024 equivalent: 1-8-2
