3.2.2

4.2.3.1 Top management shall appoint a member of the senior-level leadership team to oversee and be accountable for the organization’s IT security. Accountabilities of the member of the senior-level leadership team shall include the following:
1. developing and implementing a company-wide information cyber security program to meet baseline cyber security controls;
2. documenting and disseminating information security policies and procedures;
3. coordinating the development and implementation of a company-wide information security training and awareness program;
4. coordinating a response to actual or suspected breaches in the confidentiality, integrity, or availability of the organization’s data; and
5. identifying organizational risks and prioritizing risk treatment relative to likelihood and potential impact of cyber threats.

4.3.2.1 The organization shall train employees on basic security practices, including a focus on the following practical and easily implementable measures:
a. The use of effective password policies (see Subsection 5.5);
b. Identification of malicious emails and links;
c. Use of approved software;
d. Appropriate usage of the Internet; and
e. Safe use of social media;

5.1.2.1 The organization shall have an incident response plan for how to respond to incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization should have a plan for what it will do.

5.1.2.2 The incident response plan shall detail who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators. The organization shall have an up-to-date hard copy version of this plan available for situations where soft copies are not available.

5.1.2.3 The organization should consider purchasing a cyber security insurance policy that includes coverage for incident response and recovery activities or provide rationale for not purchasing one.

5.1.2.4 The organization may use the incident response plan template (see Annex A) as a measure of satisfying Requirements contained in Subsection 5.1.2.