Requirement
In addition to subcontrols in the ECC control 2-7-3, cybersecurity requirements for data and information protection in OT/ICS must include, at a minimum, the following:
Sub-Controls
2-6-1-1
Requirement: Electronic and physical data (at rest and in transit) must be protected at a level consistent with its classification.
2-6-1-2
Requirement: Data Leakage Prevention (DLP) mechanisms must be used to protect the classified data and information.
2-6-1-3
Requirement: Secure wiping mechanisms for configuration details and stored data from OT/ICS assets prior to decommissioning must be implemented.
2-6-1-4
Requirement: Transfer or usage of OT systems' data in any environment other than production environment must be limited, except after applying strict controls for protecting that data.
References
- ECC – 2:2024 equivalent: 2-7-3
