Protect 2.3.4 Information protection processes and procedures Draw up policies to protect information systems and assets. Apply these policies to protect those information systems and assets. Description Task PR.IP-1 Draw up a baseline configuration for your information and communication infrastructure, as well as for industrial control systems. Ensure that this baseline configuration complies with typical security principles (e.g. N-1 redundancy, least-functionality configuration, etc.). PR.IP-2 Establish a life cycle procedure for the use of ICT assets. PR.IP-3 Establish a procedure to monitor configuration changes. PR.IP-4 Ensure that backups of your information are conducted, maintained and tested on a regular basis (check that you are able to revert to your backups). PR.IP-5 Ensure that you comply with all (regulatory) requirements and policies concerning your physical assets. PR.IP-6 Ensure that data is destroyed according to requirements. PR.IP-7 Ensure that your information security procedures are enhanced and improved continuously. PR.IP-8 Share information about the effectiveness of various protection technologies with your partners. PR.IP-9 Establish response procedures for any cyber incidents that may occur. (Incident response planning, business continuity management, incident recovery, disaster recovery.) PR.IP-10 Test response and recovery plans. PR.IP-11 Embed aspects of cybersecurity in the staff recruitment process at an early stage (e.g. by conducting background checks and individual security checks). PR.IP-12 Develop and implement a procedure for dealing with identified vulnerabilities. Table 21: PR.IP tasks Minimum ICT standard 2018 24