26 Establish an identity management framework Rather than focusing primarily on separate and supporting systems to include physical access controls for individual systems, integrate access and electronic access controls across the organization’s approach to establishing and major enterprise systems. maintaining identities, striving for as much automated integration among systems as possible to reduce errors and delays. 27 Enforce privilege” access to cyber assets Ensure that employees have only the privileges “least and periodically review access privileges. they need to perform their jobs. 28 Establish an information-sharing program for Ensure that the organization as a is aware departments or functions within the organization of the security-related activities of other and designate personnel to be responsible for the departments or functions. Encourage frank key roles. Include training on what types of discussions about cyber security within the information need to be shared, with whom, and organization and foster a team-based approach, at which frequency. rather than each department relying on its own resources. 29 Categorize identity management according to Systems that access or store sensitive data organizational risk criteria so that stricter access should be protected by multiple authentication controls are required for more sensitive systems. factors. The organization’s identity management system should be flexible enough to allow multi-factor authentication. 30 Ensure that the employee evaluation process Ensure that job descriptions formally include includes responsibilities related to security, security responsibilities and that employee that these responsibilities are updated regularly, performance in this area is monitored and and they are managed to ensure they continue to rewarded. address the organization’s cyber security needs. 31 Ensure that training and recruiting efforts are Allow the organization to attract and retain top focused on cyber security. cyber security talent.
26 Establish an identity management framework and supporting systems to include physical access and electronic access controls across major enterprise systems. Rather than focusing primarily on separate access controls for individual systems, integrate the organization’s approach to establishing and maintaining identities, striving for as much automated integration among systems as possible to reduce errors and delays. 27 Enforce “least privilege” access to cyber assets and periodically review access privileges. Ensure that employees have only the privileges they need to perform their jobs. 28 Establish an information-sharing program for departments or functions within the organization and designate personnel to be responsible for the key roles. Include training on what types of information need to be shared, with whom, and at which frequency. Ensure that the organization as a is aware of the security-related activities of other departments or functions. Encourage frank discussions about cyber security within the organization and foster a team-based approach, rather than each department relying on its own resources. 29 Categorize identity management according to organizational risk criteria so that stricter access controls are required for more sensitive systems. Systems that access or store sensitive data should be protected by multiple authentication factors. The organization’s identity management system should be flexible enough to allow multi-factor authentication. 30 Ensure that the employee evaluation process includes responsibilities related to security, that these responsibilities are updated regularly, and they are managed to ensure they continue to address the organization’s cyber security needs. Ensure that job descriptions formally include security responsibilities and that employee performance in this area is monitored and rewarded. 31 Ensure that training and recruiting efforts are focused on cyber security. Allow the organization to attract and retain top cyber security talent.
2014-Coop-Cyber-Security-Plan-Template-Update-1.docx