Requirements Evidence/Narrative 5.1 It is a requirement that you have identified all locations where sensitive and businesses critical information is stored digitally. (email, web and application servers, data shares, end user devices etc) Has this been done? For the locations identified above answer the following questions 5.2 Does the organisation have a user Answer not required account creation and approval process? 5.3 Does the organisation authenticate users Answer not required before granting access in compliance with the defined password policy? 5.4 Has the organisation removed or disabled Answer not required user accounts when no longer required? 5.5 Where available, has the organisation implemented two factor authentication? 5.6 Are administrative accounts used to perform administrative activities ONLY? (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks). 5.7 Does the organisation remove or disable Answer not required special access privileges when no longer required? Please provide any additional evidence to support your assertions above: Malware Protection Objective Restrict execution of known malware and untrusted software, to prevent harmful code from causing damage or accessing sensitive data. Requirements Evidence/Narrative
Requirements Evidence/Narrative 5.1 It is a requirement that you have identified all locations where sensitive and businesses critical information is stored digitally. (email, web and application servers, data shares, end user devices etc) Has this been done? For the locations identified above answer the following questions 5.2 Does the organisation have a user account creation and approval process? Answer not required 5.3 Does the organisation authenticate users before granting access in compliance with the defined password policy? Answer not required 5.4 Has the organisation removed or disabled user accounts when no longer required? Answer not required 5.5 Where available, has the organisation implemented two factor authentication? 5.6 Are administrative accounts used to perform administrative activities ONLY? (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks). 5.7 Does the organisation remove or disable special access privileges when no longer required? Answer not required Please provide any additional evidence to support your assertions above: Malware Protection Objective Restrict execution of known malware and untrusted software, to prevent harmful code from causing damage or accessing sensitive data. Requirements Evidence/Narrative