9.2.
Vulnerability Analysis ............................................................................................................ 38
9.3.
Change Management ............................................................................................................ 39
9.4.
Business Continuity and Disaster Recovery .......................................................................... 40
10.
Information Security Incidents ................................................................................................. 42
10.1.
Detecting Information Security Incidents ......................................................................... 42
10.2.
Reporting Information Security Incidents ......................................................................... 43
10.3.
Managing Information Security Incidents ......................................................................... 44
11.
Physical Security........................................................................................................................ 47
11.1.
Facilities ............................................................................................................................. 47
11.2.
Servers and Network Devices ............................................................................................ 47
11.3.
Network Infrastructure...................................................................................................... 48
11.4.
IT Equipment...................................................................................................................... 49
11.5.
Tamper Evident Seals ........................................................................................................ 49
12.
Personnel Security .................................................................................................................... 51
12.1.
Information Security Awareness and Training .................................................................. 51
12.2.
Authorizations and Briefings ............................................................................................. 53
12.3.
Using the Internet.............................................................................................................. 54
13.
Infrastructure ............................................................................................................................ 56
13.1.
Cable Management Fundamentals ................................................................................... 56
13.2.
Cable Management for Non‐Shared Government Facilities ............................................. 56
13.3.
Cable Management for Shared Government Facilities ..................................................... 56
13.4.
Cable Management for Shared Non‐Government Facilities ............................................. 57
13.5.
Cable Labelling and Registration ....................................................................................... 58
14.
Communication Systems and Devices ...................................................................................... 60
14.1.
15.
Fax Machines, Multifunction Devices and Network Printers ............................................ 60
Product Security ........................................................................................................................ 62
15.1.
Product Selection and Acquisition..................................................................................... 62
15.2.
Product Patching and Updating......................................................................................... 63
15.3.
Product Sanitization and Disposals ................................................................................... 65
3