Essential Cybersecurity Controls (ECC – 2 : 2024) - Email Protection; Documentation and Requirements

Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-4-1

Cybersecurity Requirements For Protecting Email Service Must Be Defined, Documented And Approved.

The Cybersecurity Requirements For Email Service Must Be Implemented.

The cybersecurity requirements for protecting the email service must include at the least the following:

Analyzing and filtering email messages (specifically phishing emails and spam) using advanced and up-to-date email protection techniques.
Multi-factor authentication for remote and webmail access to email service, defining authentication factors, number of factors and suitable technique based on the result of impact assessment of authentication failure and bypass.
Email archiving and backup.
Secure management and protection against Advanced Persistent Threats (APT), which normally utilize zero-day viruses and malware.
Validation of the organization's email service domains through Haseen platform by using Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain Message Authentication Reporting and Conformance (DMARC).

The Cybersecurity Requirements For Email Service Must Be Reviewed Periodically.