Requirement
In addition to the subcontrols within control 2-2-3 in the ECC, cybersecurity requirements for identity and access management related to organization's social media accounts shall include at least the following:
Sub-Controls
2-2-1-1
Requirement: Using social media accounts designated for organizations, not individuals.
2-2-1-2
Requirement: Registering using official information (official specific social media email and official mobile number), and do not use personal information.
2-2-1-3
Requirement: Verifying organization's social media accounts whenever possible and maintaining a consistent identity across all organization's social media accounts used; to facilitate knowledge of official accounts, and to discover fraud or unofficial accounts.
2-2-1-4
Requirement: Using a secure and specific password for each organization's social media account, changing the password regularly, and not to repeate use of passwords.
2-2-1-5
Requirement: Using multi-factor authentication for organization's social media accounts logins.
2-2-1-6
Requirement: Activating and updating security questions and documenting them in a safe place.
2-2-1-7
Requirement: Managing organization's social media accounts access rights based on business need, considering the sensitivity of the accounts, the level of access rights and the type of devices and systems used.
2-2-1-8
Requirement: Restricting access rights of service providers of social media management, social media monitoring or brand protection.
2-2-1-9
Requirement: Restricting access to organization's social media accounts to specific devices.
References
- ECC – 2:2024 equivalent: 2-2-3
