8.19

4.3.2.1 The organization shall train employees on basic security practices, including but not limited to the following practices:

a. Compliance with password policies 

b. Identification of malicious communications and phishing;

c. Keeping employee devices and software updated.

d. Principle of least privilege and basic access controls.

 

 

 

6.1.3.2 Organization using mobility (i.e., cellphones) shall:

a. Require separation between work and personal data on mobile devices with access to corporate IT resources and document the details of this separation;

b. Ensure that employees only download mobile device applications (i.e., apps) from the organization’s list of trusted sources.

c. Require that all mobile devices store all sensitive information in a secure, encrypted state.

d. Consider the implementation of an enterprise mobility management solution for all mobile devices or document the risks assumed to the audit, management, and security functionality of mobile

devices by not implementing such a solution.

e. Enforce or educate users to:

– disable automatic connections to open networks;

– avoid connecting to unknown Wi-Fi networks;

– limit the use of Bluetooth and NFC for the exchange of sensitive information ; and

– use corporate Wi-Fi or cellular data network connectivity rather than public Wi-Fi.

f. Consider using secure connectivity (VPN, Virtual Desktop etc.) when connecting to public Wi-Fi networks, or provide the rationale for not doing so