Essential Cybersecurity Controls (ECC – 2 : 2024) - Networks Security Management; Documentation and Requirements

Essential Cybersecurity Controls (ECC – 2 : 2024) - 2-5-1

Cybersecurity Requirements For Network Security Management Must Be Defined, Documented And Approved.

The Cybersecurity Requirements For Network Security Management Must Be Implemented.

The cybersecurity requirements for network security management must include at least the following:

Logical or physical segregation and segmentation of network segments using firewalls and defense-in-depth principles.
Network segregation between production, test and development environments.
Secure browsing and Internet connectivity including restrictions on the use of file storage/sharing and remote access websites, and protection against suspicious websites
Wireless network protection using strong authentication and encryption techniques. A comprehensive risk assessment and management exercise must be conducted to assess and manage the cyber risks prior to connecting any wireless networks to the organization’s internal network.
Management and restrictions on network services, protocols and ports.
Intrusion Prevention Systems (IPS).
Security of Domain Name Service (DNS) through Haseen platform
Secure management and protection of Internet browsing channel against Advanced Persistent Threats (APT), which normally utilize zero-day viruses and malware.
Protecting against Distributed Denial of Service (DDoS) attacks to limit risks arising from these attacks.

The Cybersecurity Requirements For Network Security Management Must Be Reviewed Periodically.