8.12

5.6.2.1 Organizations shall determine on a case-by-case basis what business information and software (including but not limited to sensitive information) is essential to the functioning of the organization, and
how frequently this information changes.NOTE: As an example, critical workstations and servers may require daily incremental backups, whereas desktops may be recovered from one common image.

5.6.2.2 Organizations shall determine on a case-by-case basis what systems to back up and at what frequency since every system will have different back-up and recovery requirements.

5.6.2.3 Organizations shall backup systems that contain essential business information and ensure that recovery mechanisms effectively and efficiently restore these systems from backups.

5.6.2.4 Organizations shall store backups at a secure offsite location (either physically or via network separated cloud services) at regular intervals to provide diversity in the event of a disaster
(fire, flood, earthquake or localized cyber security incident).

5.6.2.5 Organizations should consider the use of encrypted backups with securely stored and recoverable key material. Decryption keys and/or unencrypted backups should be stored securely and should be
accessible only to authorized employees or officers.

5.6.3.1 Organizations shall use a sampling of backup data to test and verify recovery procedures at regular intervals to ensure the integrity of the end-to-end backup and restoration process.

5.7.3.1 The organization shall have a firewall placed between two perimeters that controls the amount and kinds of traffic that may pass between the two.

5.7.3.2 The organization should consider implementing a DNS firewall for outbound DNS requests to the Internet.

5.7.3.3 The organization shall activate any software firewalls included on devices within their networks or document the alternative measures in place instead of these firewalls.

5.7.3.4 The organization shall require encrypted connectivity to all corporate IT resources and require VPN connectivity with multi-factor authentication for all remote access into corporate networks.

5.7.3.5 The organization shall use secure Wi-Fi, at a minimum WPA2-AES, preferably WPA2-Enterprise or WPA3-Enterprise, following password requirements in section 5.5.

5.7.3.6 The organization should segment their networks to ensure networks provided to the public/customers are separated (and/or isolated) from the corporate networks.

5.7.3.7 The organization shall ensure the implementation of DMARC on all organization email services.

5.7.3.8 The organization shall ensure email filtering is implemented.