Requirement
In addition to the subcontrols in the ECC control 2-5-3, cybersecurity requirements of telework systems' network security management must include at least the following:
Sub-Controls
2-4-1-1
Requirement: Restrictions on network services, protocols and ports used to access remotely, specifically to internal systems and to only be opened based on need.
2-4-1-2
Requirement: Reviewing firewall rules and configurations, at least once every year.
2-4-1-3
Requirement: Protecting against Distributed Denial of Service Attack (DDoS) attacks to limit risks arising from these attacks.
2-4-1-4
Requirement: Protecting against Advanced Persistent Threats (APT) at the network layer.
References
- ECC – 2:2024 equivalent: 2-5-3
