Requirement
In addition to the subcontrols in the ECC control 2-3-3, cybersecurity requirements for protecting telework systems and information processing facilities must include at least the following:
Sub-Controls
2-3-1-1
Requirement: Applying updates and security patches for telework systems at least once every three months.
2-3-1-2
Requirement: Reviewing telework systems' configurations and hardening at least once every year.
2-3-1-3
Requirement: Reviewing and changing default configurations, and ensuring the removal of hard-coded, backdoor and/or default passwords.
2-3-1-4
Requirement: Securing Session Management which includes the session authenticity, lockout, and timeout.
2-3-1-5
Requirement: Restricting the activation of the features and services of the telework systems based on needs, provided that potential cyber risks are analyzed in case there is a need to activate them.
References
- ECC – 2:2024 equivalent: 2-3-3
