Requirement
[A: M | B: M] Cybersecurity requirements for network security management must be defined, documented and approved, covering at minimum:
Sub-Controls
2-5-1-1
Requirement: [A: M | B: M] Use of network firewalls and secure access gateways.
2-5-1-2
Requirement: [A: M | B: R] Secure physical or logical isolation and segmentation of network segments.
2-5-1-3
Requirement: [A: M | B: M] Security and protection of wireless networks using secure authentication and encryption methods.
2-5-1-4
Requirement: [A: M | B: R] Secure browsing and Internet connectivity, including strict restriction of suspicious websites, file sharing/storage sites, and remote access sites.
2-5-1-5
Requirement: [A: M | B: R] Restriction and management of network ports, protocols and services.
2-5-1-6
Requirement: [A: M | B: R] Advanced protection systems for intrusion detection and prevention (Intrusion Prevention Systems).
2-5-1-7
Requirement: [A: M | B: R] Protection against Distributed Denial of Service (DDoS) attacks to limit the cyber risks arising from network-disruption attacks.
