proprietary threat and vulnerability information (under NDA) that may precede public release of similar data. Identity Administration: Network Operators and Service Providers should have procedures for verifying identity of 8-8-8075 users to IT department and IT personnel to users (secret PINs, Cyber Security Important X X X X X X X X callback procedures, etc.). Training for Security Staff: Service Providers, Network Operators, and Equipment Suppliers should establish security 8-8-8100 training programs and requirements for ensuring security staff Cyber Security Important X X X X X X knowledge and compliance. This training could include professional certifications in cyber security. Document and Verify All Security Operational Procedures: Service Providers and Network Operators should ensure that all security operational procedures, system processes, and security controls are documented, and that documentation is up to date and accessible by appropriate staff. Perform gap 8-8-8101 Cyber Security Important X X X X X X X X X X analysis/audit of security operational procedures as often as security policy requires relative to the asset being protected. Using results of analysis or audit, determine which procedures, processes, or controls need to be updated and documented.
proprietary threat and vulnerability information (under NDA) that may precede public release of similar data. 8-8-8075 Identity Administration: Network Operators and Service Providers should have procedures for verifying identity of users to IT department and IT personnel to users (secret PINs, callback procedures, etc.). Cyber Security Important X X X X X X X X 8-8-8100 Training for Security Staff: Service Providers, Network Operators, and Equipment Suppliers should establish security training programs and requirements for ensuring security staff knowledge and compliance. This training could include professional certifications in cyber security. Cyber Security Important X X X X X X 8-8-8101 Document and Verify All Security Operational Procedures: Service Providers and Network Operators should ensure that all security operational procedures, system processes, and security controls are documented, and that documentation is up to date and accessible by appropriate staff. Perform gap analysis/audit of security operational procedures as often as security policy requires relative to the asset being protected. Using results of analysis or audit, determine which procedures, processes, or controls need to be updated and documented. Cyber Security Important X X X X X X X X X X
CSRIC%20III%20Report%20WG8%20June%202012.docx