5.10

4.3.2.1 The organization shall train employees on basic security practices, including but not limited to the following practices:

a. Compliance with password policies (see Subsection 5.5); b. Identification of malicious communications and phishing;

c. Keeping employee devices and software updated.

d. Principle of least privilege and basic access controls.

 

 

 

6.1.3.1 Organization using mobility (i.e., cellphones) shall decide on an ownership model for mobile devices and document the rationale and associated risks.

 

6.1.3.2 Organization using mobility (i.e., cellphones) shall:a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;

b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources.

c. Require that all mobile devices store all sensitive information in a secure, encrypted state.

d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile

devices by not implementing such a solution.

e. Enforce or educate users to:

– disable automatic connections to open networks;

– avoid connecting to unknown Wi-Fi networks;

– limit the use of Bluetooth and NFC for the exchange of sensitive information ; and

– use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi.

f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so

 

 

6.4.2.1 Organizations using portable media shall mandate the sole use of organization-owned secure portable media.

 

 

6.4.3.1 Organizations using portable media shall:

a. Have strong asset controls for these devices;

b. Require the use of encryption on all of these devices; and

c. Have processes for the sanitization or destruction of portable media prior to disposal.