Security logging must be 3.2.18 Recommended Recommended Recommended Optional monitored 24x7. Storage media and systems must 3.2.19 be clearly labeled with Restricted Required N/A N/A N/A Data Stickers. 3.3. Minimum Standards for Network Controls standards define network access that connect systems. Data Protection Level Standard Restricted High Moderate Low System must be on a firewall protected network shared only with 3.3.1 Required Recommended Recommended Optional systems in the same security domain. All network transit of Protected Data 3.3.2 across the network must be Required Required Required N/A encrypted. No cleartext transmission of 3.3.3 Required Required Required Required passwords shall be permitted. Network access be restricted to the minimum necessary to perform 3.3.4 Required Required Required Optional required functions. (example: Firewalls) 3.4. Minimum Standards for Physical Controls Best practices for physical securing of equipment. Data Protection Standard Restricted High Moderate Low Systems must be located in a 3.4.1 Required Recommended Recommended N/A locked room with limited access. Systems must be located in a 3.4.2 Required Optional Optional Optional locked rack or cage. Backup media must be physically 3.4.3 Required Required Required Recommended secured from unauthorized access. Backup media must be stored in a 3.4.4 Required Recommended Recommended Recommended physically diverse location. Systems must be provided with power protection (conditioning, 3.4.5 Required Recommended Recommended Optional uninterruptable power supply [UPS], and backup generator). Systems must be located in a room 3.4.6 with appropriate environmental Required Recommended Recommended Recommended (e.g., heat and humidity) controls.
3.2.18 Security logging must be monitored 24x7. Recommended Recommended Recommended Optional 3.2.19 Storage media and systems must be clearly labeled with Restricted Data Stickers. Required N/A N/A N/A 3.3. Minimum Standards for Network Controls standards define network access that connect systems. Standard Data Protection Level Restricted High Moderate Low 3.3.1 System must be on a firewall protected network shared only with systems in the same security domain. Required Recommended Recommended Optional 3.3.2 All network transit of Protected Data across the network must be encrypted. Required Required Required N/A 3.3.3 No cleartext transmission of passwords shall be permitted. Required Required Required Required 3.3.4 Network access be restricted to the minimum necessary to perform required functions. (example: Firewalls) Required Required Required Optional 3.4. Minimum Standards for Physical Controls Best practices for physical securing of equipment. Standard Data Protection Restricted High Moderate Low 3.4.1 Systems must be located in a locked room with limited access. Required Recommended Recommended N/A 3.4.2 Systems must be located in a locked rack or cage. Required Optional Optional Optional 3.4.3 Backup media must be physically secured from unauthorized access. Required Required Required Recommended 3.4.4 Backup media must be stored in a physically diverse location. Required Recommended Recommended Recommended 3.4.5 Systems must be provided with power protection (conditioning, uninterruptable power supply [UPS], and backup generator). Required Recommended Recommended Optional 3.4.6 Systems must be located in a room with appropriate environmental (e.g., heat and humidity) controls. Required Recommended Recommended Recommended
Minimum%20Security%20Standards%202015-08-01.docx