Cyber Security
Security Policy and Procedures
The public institution shall as a minimum have a documented Information Security Policy (ISP) bas...
Minimizing the exposure of systems to External Networks
Install and configure gateway firewall. Configure inbound and outbound Access Control List (AC...
Access Control
The institution shall limit system access to authorized users, processes acting on behalf of au...
Implement network segmentation
Access control: It shall start with IT assets, data, and personnel classification into specific...
Institution awareness and Training
The institution shall ensure that executives, senior management, managers, systems administrators...
Audit and Accountability
The institution shall create and retain system audit logs and records to the extent needed to ena...
Configuration Management
The institution shall establish and maintain baseline configurations and inventories of instituti...
Identity Management and Authentication
The institution shall identify system users, processes acting on behalf of users, and devices. ...
Incident Response
The institution shall have an operational incident-handling capability for institutional systems,...
Maintenance
The institution shall perform maintenance on institutional digitalization systems. The institu...
Media Protection
The institution shall protect (i.e., physically control and securely store) system media contai...
Personnel Security
The public institution shall identify (inventories) its own human resources. For each official ...
Physical and Environmental Protection
The institution shall divide the area it manages into security zones based on risk assessment t...
Risk Assessment
The institution shall periodically (at least once a year) assess the risk to institutional operat...
System and Communications Protection
The institution shall monitor, control, and protect communications (i.e., information transmitt...
System and Information Integrity
The institution shall identify, report, and correct system security flaws on time. The institu...
Personally identifiable information (PII) Processing and Transparency
The institution shall identify and meet the requirements for preserving privacy and protecting PI...
Contingency Planning
The institution shall ensure that backup copies of data, software and system images are regular...
Supply Chain Risk Management
In collaboration with a competent authority where applicable, the institution shall establish a...
Passwords Protection
Users shall have different passwords for different accounts. All default passwords shall be ch...