+NET.1.1.A1 Security Policy for the Network [IT Operation Department] (B)

NET.1.1.A1 Security Policy for the Network [IT Operation Department] (B)

Based on an organisation's general security policy, a specific policy SHOULD be drawn up for its network. It MUST comprehensibly describe requirements and specifications on how to design and construct networks securely. The policy MUST include definitions of the following:

  • the cases in which zones have to be segmented and user groups or clients have to be separated logically, or even physically
  • which communication relationships and which network and application protocols are permitted in each case
  • how the data traffic for administration and monitoring is to be separated in the network
  • what type of internal communication (WAN, wireless networks) is allowed across locations and what encryption is required on WAN, LAN, or radio links
  • what type of cross-location communication is permitted

All the employees responsible for network design MUST be familiar with the policy. It MUST form the basis of their work. If the policy is changed or there are deviations from the requirements specified, this MUST be documented and agreed with the CISO in charge. The correct implementation of the policy MUST be regularly reviewed. The results MUST be documented in an appropriate manner.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.29 Violations of Laws or Regulations