Sharing Indicator: White Essential Cybersecurity Controls 2 2-1 Cybersecurity Defense Asset Management To ensure that the organization has an accurate and detailed inventory of information and Objective technology assets in order to support the organization’s cybersecurity and operational requirements to maintain the confidentiality, integrity and availability of information and technology assets. Controls 2-1-1 2-1-2 2-1-3 2-1-4 2-1-5 2-1-6 2-2 Objective Cybersecurity requirements for managing information and technology assets must be defined, documented and approved. The cybersecurity requirements for managing information and technology assets must be implemented. Acceptable use policy of information and technology assets must be defined, documented and approved. Acceptable use policy of information and technology assets must be implemented. Information and technology assets must be classified, labeled and handled as per related law and regulatory requirements. The cybersecurity requirements for managing information and technology assets must be reviewed periodically. Identity and Access Management To ensure the secure and restricted logical access to information and technology assets in order to prevent unauthorized access and allow only authorized access for users which are necessary to accomplish assigned tasks. Controls 2-2-1 2-2-2 Cybersecurity requirements for identity and access management must be defined, documented and approved. The cybersecurity requirements for identity and access management must be implemented. The cybersecurity requirements for identity and access management must include at least the following 2-2-3 2-2-4 2-2-3-1 User authentication based on username and password. 2-2-3-2 Multi-factor authentication for remote access. 2-2-3-3 User authorization based on identity and access control principles: Need-to-Know 2-2-3-4 Privileged access management. 2-2-3-5 Periodic review of users’ identities and access rights. and Need-to-Use, Least Privilege and Segregation of Duties. The Implementation of the cybersecurity requirements for identity and access management must be reviewed periodically. Document Classification: Unclassified 19