Requirement
In addition to the subcontrols in ECC control 1-10-3, the cybersecurity awareness program must cover topics related to data protection, including the following:
Sub-Controls
1-3-1-1
Requirement: Risks of data leakage and unauthorized access to data during its lifecycle.
1-3-1-2
Requirement: Secure handling of classified data while traveling and outside the workplace.
1-3-1-3
Requirement: Secure handling of data during meetings (virtual and in-person).
1-3-1-4
Requirement: Secure use of printers, scanners and copy machines.
1-3-1-5
Requirement: Procedures for secure data disposal.
1-3-1-6
Requirement: Risks of sharing documents and information through non-secure channels.
1-3-1-7
Requirement: Cybersecurity risks related to the use of external storage media.
References
- ECC – 2:2024 equivalent: 1-10-3
