Requirement
In addition to the subcontrols in ECC control 2-7-3, cybersecurity requirements for data and information protection must cover at least the following:
Sub-Controls
2-4-1-1
Requirement: Using Watermark feature to label the whole document when creating, storing, printing, on the screen and on each copy so that the symbol can be traced to the user or device level.
2-4-1-2
Requirement: Using Data Leakage Prevention technologies and Rights Management technologies.
2-4-1-3
Requirement: Prohibiting the use of data in any environment other than the production environment, except after conducting a risk assessment and applying controls to protect that data, such as: data masking or data scrambling techniques.
2-4-1-4
Requirement: Using brand protection service to protect the organization's identity from impersonation.
References
- ECC – 2:2024 equivalent: 2-7-3
