APP.5.3.A6 Defining a Security Policy for E-Mail (S)
An organisation SHOULD establish and regularly update a security policy for the use of e-mail. The organisation SHOULD inform all users and administrators of new or changed security requirements for e-mail applications. The organisation's e-mail security policy SHOULD comply with its generally applicable security policies. The organisation SHOULD check that the security policy is being applied correctly. The e-mail security policy for users SHOULD specify the following: - how these communications can be secured
- what user access rights exist
- how e-mails are checked for forged senders
- how to secure transmitted information
- how to check the integrity of e-mails
- which open e-mail distribution lists may be used
- whether private e-mail use is permitted
- how to deal with e-mails and mailboxes of employees who leave the company
- whether and how webmail services may be used
- who is responsible for group mailboxes
- how file attachments should be handled
- how e-mails in HTML format should be handled by users
The e-mail security policy SHOULD also include the configuration options of the e-mail applications for administrators, as well as the specifications for possible access to an e-mail server from other servers. Information on authorised points from which an e-mail server may be accessed SHOULD also be included in the policy. The e-mail security policy SHOULD regulate the handling of newsgroups and mailing lists.
1. Επισκόπηση
1.1 Παραπομπές
1.2 Εντοπισμένες απαιτήσεις
1.3 Σχετικοί κανονισμοί
2. Εντοπισμένες απαιτήσεις
3. Σχετικοί κανονισμοί
Κανονισμοί
| Πηγή |
Κανονισμός |
Συνδεδεμένα ζητήματα
|