Sharing Indicator: White Essential Cybersecurity Controls 2-14 Objective Physical Security To ensure the protection of information and technology assets from unauthorized physical access, loss, theft and damage. Controls 2-14-1 2-14-2 Cybersecurity requirements for physical protection of information and technology assets must be defined, documented and approved. The cybersecurity requirements for physical protection of information and technology assets must be implemented. The cybersecurity requirements for physical protection of information and technology assets must include at least the following: 2-14-3-1 Authorized access to sensitive areas within the organization (e.g., data center, disaster recovery center, sensitive information processing facilities, security surveillance center, 2-14-3 network cabinets). 2-14-3-2 Facility entry/exit records and CCTV monitoring. 2-14-3-3 Protection of facility entry/exit and surveillance records. 2-14-3-4 Secure destruction and re-use of physical assets that hold classified information (including documents and storage media). 2-14-3-5 Security of devices and equipment inside and outside the organization’s facilities. 2-14-4 The cybersecurity requirements for physical protection of information and technology assets must be reviewed periodically. 2-15 Web Application Security Objective To ensure the protection of external web applications against cyber risks. Controls 2-15-1 2-15-2 Cybersecurity requirements for external web applications must be defined, documented and approved. The cybersecurity requirements for external web applications must be implemented. The cybersecurity requirements for external web applications must include at least the following: 2-15-3-1 Use of web application firewall. 2-15-3 2-15-3-2 Adoption of the multi-tier architecture principle. 2-15-3-3 Use of secure protocols (e.g., HTTPS). 2-15-3-4 Clarification of the secure usage policy for users. 2-15-3-5 Multi-factor authentication for users’ access. 2-15-4 The cybersecurity requirements for external web applications must be reviewed periodically. Document Classification: Unclassified 25