5.32

4.3.2.1 The organization shall train employees on basic security practices, including a focus on the following practical and easily implementable measures:
a. The use of effective password policies (see Subsection 5.5);
b. Identification of malicious emails and links;
c. Use of approved software;
d. Appropriate usage of the Internet; and
e. Safe use of social media;

6.1.3.1 Organization using mobility (i.e., cellphones) shall decide on an ownership model for mobile devices and document the rationale and associated risks.

6.1.3.2 Organization using mobility (i.e., cellphones) shall:a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;
b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources.
c. Require that all mobile devices store all sensitive information in a secure, encrypted state.
d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile
devices by not implementing such a solution.
e. Enforce or educate users to:
– disable automatic connections to open networks;
– avoid connecting to unknown Wi-Fi networks;
– limit the use of Bluetooth and NFC for the exchange of sensitive information ; and
– use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi.
f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so

6.2.2.1 Organization using cloud applications and/or outsourcing IT services shall evaluate their risk tolerance level with how their outsourced IT providers handle and access their sensitive information.

6.2.3.1 The organization using cloud applications and/or outsourcing IT services shall:
a. Require that all their cloud service providers share an AICPA SSAE 18 or equivalent report that states that they achieved Trust Service Principles compliance or provide a documented business case as
why they chose not to;
NOTE: The organization determines equivalence to AICPA SSAE 18.
b. Evaluate their risk tolerance level with the legal jurisdictions where their outsourced providers store or use their sensitive information;
c. Ensure that their IT infrastructure and users communicate securely with all cloud services and applications; and
d. Ensure that administrative accounts for cloud services use multi-factor authentication and differ from internal administrator accounts.

6.3.3.1 Organizations deploying websites shall ensure that their websites address the OWASP top 10 vulnerabilities.
NOTE: For a comprehensive list of vulnerability scanning tools, please visit the “Vulnerability Scanning Tools” page on the OWASP website.

6.3.3.2 Organizations shall ensure that they understand the OWASP ASVS level they need to meet for each of their websites.

6.4.2.1 Organizations using portable media shall mandate the sole use of organization-owned secure portable media.

6.4.3.1 Organizations using portable media shall:
a. Have strong asset controls for these devices;
b. Require the use of encryption on all of these devices; and
c. Have processes for the sanitization or destruction of portable media prior to disposal.