Requirement
In addition to the controls within subdomain 1-5 in the ECC, requirements for cybersecurity risk management should include at least the following:
Sub-Controls
1-2-1-1
Requirement: Assessment of the cybersecurity risks for telework systems, once per year at least.
1-2-1-2
Requirement: Assessment of cybersecurity risks during planning and before permitting telework for any service or system.
1-2-1-3
Requirement: Including the cybersecurity risks related to telework systems and its related services and systems in the entity's cybersecurity risk register, and monitoring it at least once a year.
References
- ECC – 2:2024 equivalent: 1-5
