Sharing Indicator: White Essential Cybersecurity Controls 2-5 Networks Security Management Objective To ensure the protection of organization’s network from cyber risks. Controls 2-5-1 Cybersecurity requirements for network security management must be defined, documented and approved. 2-5-2 The cybersecurity requirements for network security management must be implemented. The cybersecurity requirements for network security management must include at least the following: 2-5-3 2-5-3-1 Logical or physical segregation and segmentation of network segments using 2-5-3-2 Network segregation between production, test and development environments. 2-5-3-3 Secure browsing and Internet connectivity including restrictions on the use of file firewalls and defense-in-depth principles. storage/sharing and remote access websites, and protection against suspicious websites. 2-5-3-4 Wireless network protection using strong authentication and encryption techniques. A comprehensive risk assessment and management exercise must be conducted to assess and manage the cyber risks prior to connecting any wireless networks to the organization’s internal network. 2-5-3-5 Management and restrictions on network services, protocols and ports. 2-5-3-6 Intrusion Prevention Systems (IPS). 2-5-3-7 Security of Domain Name Service (DNS). 2-5-3-8 Secure management and protection of Internet browsing channel against Advanced Persistent Threats (APT), which normally utilize zero-day viruses and malware. 2-5-4 The cybersecurity requirements for network security management must be reviewed periodically. 2-6 Mobile Devices Security Objective To ensure the protection of mobile devices (including laptops, smartphones, tablets) from cyber risks and to ensure the secure handling of the organization’s information (including sensitive information) while utilizing Bring Your Own Device (BYOD) policy. Controls 2-6-1 2-6-2 Cybersecurity requirements for mobile devices security and BYOD must be defined, documented and approved. The cybersecurity requirements for mobile devices security and BYOD must be implemented. The cybersecurity requirements for mobile devices security and BYOD must include at least the following: 2-6-3-1 Separation and encryption of organization’s data and information stored on mobile 2-6-3 devices and BYODs. 2-6-3-2 Controlled and restricted use based on job requirements. 2-6-3-3 Secure wiping of organization’s data and information stored on mobile devices and BYOD in cases of device loss, theft or after termination/separation from the organization. 2-6-3-4 Security awareness for mobile devices users. Document Classification: Unclassified 21