Sharing Indicator: White Essential Cybersecurity Controls 1-8 Objective Periodical Cybersecurity Review and Audit To ensure that cybersecurity controls are implemented and in compliance with organizational policies and procedures, as well as related national and international laws, regulations and agreements. Controls 1-8-1 Cybersecurity reviews must be conducted periodically by the cybersecurity function in the organization to assess the compliance with the cybersecurity controls in the organization. Cybersecurity audits and reviews must be conducted by independent parties outside the 1-8-2 cybersecurity function (e.g., Internal Audit function) to assess the compliance with the cybersecurity controls in the organization. Audits and reviews must be conducted independently, while ensuring that this does not result in a conflict of interest, as per the Generally Accepted Auditing Standards (GAAS), and related laws and regulations. 1-8-3 Results from the cybersecurity audits and reviews must be documented and presented to the cybersecurity steering committee and Authorizing Official. Results must include the audit/review scope, observations, recommendations and remediation plans. 1-9 Cybersecurity in Human Resources Objective To ensure that cybersecurity risks and requirements related to personnel (employees and contractors) are managed efficiently prior to employment, during employment and after termination/separation as per organizational policies and procedures, and related laws and regulations. Controls 1-9-1 1-9-2 Personnel cybersecurity requirements (prior to employment, during employment and after termination/separation) must be defined, documented and approved. The personnel cybersecurity requirements must be implemented. The personnel cybersecurity requirements prior to employment must include at least the following: 1-9-3 1-9-3-1 Inclusion of personnel cybersecurity responsibilities and non-disclosure clauses (covering the cybersecurity requirements during employment and after termination/ separation) in employment contracts. 1-9-3-2 Screening or vetting candidates of cybersecurity and critical/privileged positions. The personnel cybersecurity requirements during employment must include at least the following: 1-9-4 1-9-5 1-9-6 1-9-4-1 Cybersecurity awareness (during on-boarding and during employment). 1-9-4-2 Implementation of and compliance with the cybersecurity requirements as per the organizational cybersecurity policies and procedures. Personnel access to information and technology assets must be reviewed and removed immediately upon termination/separation. Personnel cybersecurity requirements must be reviewed periodically. Document Classification: Unclassified 17