NIST CSF 2.0, ProtectPR.IR-01

Guarantee the security of the services you offer, and put in place the technical processes and means needed to fight cyber fraud.

Develop, document and implement network security management policies that segregate and segment ICT systems and networks, document network connections and data flows, use a separate and dedicated network for the administration of ICT assets, apply network access controls, encrypt network connections, review the network architecture once a year (periodically if you are a microenterprise), and verify the adequacy of firewall rules and connection filters for ICT systems supporting critical or important functions at least every 6 months (Article 13).

Take appropriate technical and organizational measures, jointly with other service providers where necessary, to safeguard the security of your services.

If you operate a public telecommunications network or provide a publicly available telecommunications service, take appropriate technical and organisational measures against disruptions that significantly impair networks and services and to control the risks to their security, including encryption where appropriate and measures that secure systems against unauthorised access and limit the effects of security breaches (Section 165(2)).

The Department says you should consider expeditiously identifying and remediating known exploited vulnerabilities in firmware, hardware and software, especially on systems exposed to the Internet; disabling inactive or unnecessary ports and protocols where possible; establishing network access protections and segmenting networks; and reviewing and validating cloud application configurations against your risk tolerance.

Provide protection, technical security and safety for the Licensee's own facilities, equipment and communication networks, so as to ensure system efficiency and reliability (Sec. 88(3)).

As a 5G corporate user with spectrum rights for a private 5G network or self-supply services, guarantee the secure installation, deployment and operation of your private 5G network and the secure provision of your 5G services (Article 15(1)).

Implement technical and organizational methods to protect communication networks, telecommunications facilities, restricted-access information about the organization of communication networks, and information transmitted over those networks, and cooperate with law-enforcement bodies to protect communication facilities and structures from unauthorized access.

Ensure the cyber-defense of the communication and technological systems of your critical infrastructure object, and protect its technological information, in accordance with legislative requirements.

If you provide Internet access service, additionally draft internal security-operation procedures, name the person responsible for network security, and adopt technical and organizational measures against malware contamination and network attacks and intrusions.

Provide a security system covering procedures and technical measures, such as antivirus, anti-spam, a firewall, intrusion detection or prevention, or an information security management system, to prevent and counter a threat or attack against your Electronic System.

If you operate a public communications network or offer an electronic communications service, secure the network and the service, and tell subscribers about any particular risk of a security breach and the measures to take.