Protect

Identity management life cycles are defined.

The entity shall verify the identity of the users and bind them to their credentials.

Authentication mechanisms for users, devices and other assets are defined.

Identity statements are protected, transmitted and verified.

Permissions, rights and authorizations are managed according to the lowest privilege and separation of functions.

Physical access controls are managed, monitored and applied according to risk.

The entity manages its remote accesses.

All personnel are sensitized and trained in cybersecurity matters.

Specialized staff and management bodies shall receive appropriate training in their duties.

The entity protects the confidentiality, integrity and availability of data at rest.

The entity shall protect the confidentiality, integrity and availability of the data in transit.

The entity implements protections that avoid data exfiltration.

The entity protects the confidentiality, integrity and availability of the data in use.

Data backups are performed, maintained and tested.

A secure base configuration of networks and information systems is created and maintained.

Logs and activity history are documented, implemented and reviewed.

Unauthorized software installation and execution are prevented.

A safe software development life cycle is implemented.

The entity protects the integrity of communications networks.

The development and testing environments are separated from the production environments.

Technological assets are protected from natural threats.

Mechanisms are implemented to meet resilience requirements in adverse situations.

The entity shall plan appropriate capacity to ensure the availability of networks and systems.