Requirement
In addition to the subcontrols in ECC control 2-3-3, cybersecurity requirements for Information System and Information Processing Facilities Protection must include at least the following:
Sub-Controls
2-2-1-1
Requirement: Applying security patches and updates from the time of announcement on systems used to handle data as specified for each data classification level. Required frequency by data classification level. Public: At least every month. Confidential: At least every month. Secret: Immediately. Top Secret: Immediately.
2-2-1-2
Requirement: Reviewing the security configuration and hardening of systems used to handle data as specified for each data classification level. Required frequency by data classification level. Public: At least annually. Confidential: At least annually. Secret: At least every 6 months. Top Secret: At least every 6 months.
2-2-1-3
Requirement: Reviewing and hardening the default configuration (e.g., default passwords and backgrounds) of the technology assets used to handle the data.
2-2-1-4
Requirement: Disabling the Print Screen or Screen Capture features on the devices that create or process documents.
References
- ECC – 2:2024 equivalent: 2-3-3
