Requirement
In addition to the subcontrols within control 4-1-2 in ECC, cybersecurity requirements for use of social media management, automated monitoring or brand protection services in the organization must include at least the following:
Sub-Controls
3-1-2-1
Requirement: Non-disclosure clauses and secure removal of organization's data by the third-party upon service termination.
3-1-2-2
Requirement: Communication procedures to report vulnerabilities and cyber incidents.
3-1-2-3
Requirement: Requirments for the third-party to comply with cybersecurity requirements and policies to protect organizations' social media accounts, and related laws and regulation.
References
- ECC – 2:2024 equivalent: 4-1-2
