Sharing Indicator : White Essential Cybersecurity Controls 2-6-4 The cybersecurity requirements for mobile devices security and BYOD must be reviewed periodically. 2-7 Data and Information Protection Objective To ensure the confidentiality, integrity and availability of organization’s data and information as per organizational policies and procedures, and related laws and regulations. Controls 2-7-1 2-7-2 Cybersecurity requirements for protecting and handling data and information must be defined, documented and approved as per the related laws and regulations. The cybersecurity requirements for protecting and handling data and information must be implemented. The cybersecurity requirements for protecting and handling data and information must include at least the following: 2-7-3 2-7-3-1 Data and information ownership. 2-7-3-2 Data and information classification and labeling mechanisms. 2-7-3-3 Data and information privacy. 2-7-4 2-8 Objective The cybersecurity requirements for protecting and handling data and information must be reviewed periodically. Cryptography To ensure the proper and efficient use of cryptography to protect information assets as per organizational policies and procedures, and related laws and regulations. Controls 2-8-1 Cybersecurity requirements for cryptography must be defined, documented and approved. 2-8-2 The cybersecurity requirements for cryptography must be implemented. The cybersecurity requirements for cryptography must include at least the following: 2-8-3 2-8-3-1 Approved cryptographic solutions standards and its technical and regulatory limitations. 2-8-3-2 Secure management of cryptographic keys during their lifecycles. 2-8-3-3 Encryption of data in-transit and at-rest as per classification and related laws and regulations. 2-8-4 The cybersecurity requirements for cryptography must be reviewed periodically. 2-9 Backup and Recovery Management Objective To ensure the protection of organization’s data and information including information systems and software configurations from cyber risks as per organizational policies and procedures, and related laws and regulations. Controls 2-9-1 22 Cybersecurity requirements for backup and recovery management must be defined, documented and approved. Document Classification: Unclassified