3.4.5

5.5.2.1 Organizations shall implement multi-factor authentication or document all instances where they cannot or make the business decision not to do so.

5.5.2.2 Organizations shall enforce password changes on suspicion or evidence of compromise.

5.5.2.3 Organizations shall have clear policies on password length and reuse, the use of password managers and if, when, and how users can physically write down and securely store a password.
NOTE: Organizations may use password selection guidance from the Communications Security Establishment’s User Authentication Guidance for Information Technology Systems

5.5.3.1 Organizations shall implement a password manager or document the business decision not to do so.
NOTE: Guidance document – Guidance documents as references to the Bibliography.
https://www.cyber.gc.ca/en/guidance/best-practices-passphrases-and-passwords-itsap30032

5.7.3.1 The organization shall have a firewall placed between two perimeters that controls the amount and kinds of traffic that may pass between the two.

5.7.3.2 The organization should consider implementing a DNS firewall for outbound DNS requests to the Internet.

5.7.3.3 The organization shall activate any software firewalls included on devices within their networks or document the alternative measures in place instead of these firewalls.

5.7.3.4 The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.

5.7.3.5 The organization shall use secure Wi-Fi, at a minimum WPA2-AES, preferably WPA2-Enterprise or WPA3-Enterprise, following password requirements in section 5.5.

5.7.3.6 The organization should segment their networks to ensure networks provided to the public/customers are separated (and/or isolated) from the corporate networks.

5.7.3.7 The organization shall ensure the implementation of DMARC on all organization email services.

5.7.3.8 The organization shall ensure email filtering is implemented.

5.8.3.1 The organization shall provision accounts with the minimum functionality necessary for tasks and shall restrict administrator privileges to an as-required basis.

5.8.3.2 The organization shall remove accounts and/or functionality when users no longer require these for their tasks.

5.8.3.3 The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).

5.8.3.4 The organization should consider the implementation of a centralized authorization control system.