Content library
CyberFundamentals (Belgium)
PR.DS-5: Protections against data leaks are implemented.

How to fill the requirement

CyberFundamentals (Belgium)

PR.DS-5: Protections against data leaks are implemented.

Task name
Priority
Status
Theme
Policy
Other requirements
Process for managing technical vulnerabilities
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Development and cloud
Technical vulnerability management
requirements

Task is fulfilling also these other security requirements

12.6.1: Management of technical vulnerabilities
ISO27 Full
14.2.1: Secure development policy
ISO27 Full
ID.RA-1: Asset vulnerabilities
NIST
PR.IP-12: Vulnerability management plan
NIST
RS.AN-5: Vulnerability management process
NIST
1. Task description

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

  • risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
  • necessary actions are scheduled
  • all actions taken are documented
Encryption of backup data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Technical cyber security
Encryption
requirements

Task is fulfilling also these other security requirements

12.3.1: Information backup
ISO27 Full
10.1.1: Policy on the use of cryptographic controls
ISO27 Full
12.3: Backup
ISO27 Full
TEK-20: Varmuuskopiointi
Julkri
8.13: Information backup
ISO27k1 Full
1. Task description

When the confidentiality of backups is important, backups are protected by encryption. The need to encrypt backups may become highlighted when backups are stored in a physical location where security policies are unknown.

Defining cyber security responsibilities and tasks in employment contracts
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
requirements

Task is fulfilling also these other security requirements

7.1.2: Terms and conditions of employment
ISO27 Full
7.3: Termination and change of employment
ISO27 Full
7.3.1: Termination or change of employment responsibilities
ISO27 Full
PR.DS-5: Data leak protection
NIST
PR.IP-11: Cybersecurity in human resources
NIST
1. Task description

The employment contracts specify the responsibilities of the employee and the organization for cyber security.

Contracts should include e.g.:

  • the employee's legal responsibilities and rights, such as those related to copyright or data protection law
  • the employee's responsibility for following the instructions, e.g. related to the use of hardware and data and the classification of information
  • the employee's or temporary employee's responsibility for processing information received from other companies or other parties
  • measures if the employee or temporary worker violates the safety requirements of the organization
  • continuing obligations after termination of employment
Maintaining confidentiality agreements
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Cyber security in contracts
requirements

Task is fulfilling also these other security requirements

T10: Salassapito- ja vaitiolositoumukset
Katakri
7.1.2: Terms and conditions of employment
ISO27 Full
7.3: Termination and change of employment
ISO27 Full
7.3.1: Termination or change of employment responsibilities
ISO27 Full
13.2.4: Confidentiality or non-disclosure agreements
ISO27 Full
1. Task description

All employees handling confidential information should sign a confidentiality or non-disclosure agreement before processing confidential information.

The confidentiality commitment should include, among other things:

  • a clear definition of confidential information
  • the expected duration of the commitment
  • required actions when the commitment is terminated
  • the responsibilities and actions of signatories to prevent unauthorized disclosure of information
  • ownership of information, trade secrets, and intellectual property and how this relates to the protection of confidential information
  • permissible use of confidential information and the signatory's rights to use the information
  • the right to audit and monitor activities involving confidential information

The requirements and needs for confidentiality agreements are reviewed and updated at regular intervals.

Informing about cyber security responsibilities that continue after employment relationship has ended
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Personnel security
Changes in employment relationships
requirements

Task is fulfilling also these other security requirements

7.3: Termination and change of employment
ISO27 Full
7.3.1: Termination or change of employment responsibilities
ISO27 Full
PR.DS-5: Data leak protection
NIST
6.5: Responsibilities after termination or change of employment
ISO27k1 Full
CC2.2: Internal communication of information
SOC 2
1. Task description

The employment contract should distinguish between cyber security responsibilities and obligations that remain in force after the termination of the employment relationship. The employee should also be reminded of these at the end of the employment relationship to ensure compliance.

Using data loss prevention policies
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
requirements

Task is fulfilling also these other security requirements

18.1.2: Intellectual property rights
ISO27 Full
18.1.3: Protection of records
ISO27 Full
8.12: Data leakage prevention
ISO27k1 Full
5.33: Protection of records
ISO27k1 Full
C1.1: Identification and maintainment of confidental information
SOC 2
1. Task description

Data Loss Prevention (DLP) policies can be used to protect sensitive data from accidental or intentional disclosure. Policies can alert, for example, when they detect sensitive data (such as personal identification numbers or credit card numbers) in email or another data system to which they would not belong.

The organization defines DLP policies related to endpoints in a risk-based manner, taking into account the data classification of the processed data.

No items found.