Division (g) ICT securityF1

for enterprises with computers:

• use as an ICT security measure: strong password authentication;

• use as an ICT security measure: keeping the software (including operating systems) up-to-date;

• use as an ICT security measure: user identification and authentication via biometric methods implemented by the enterprise;

• use as an ICT security measure: encryption techniques for data, documents or e-mails;

• use as an ICT security measure: data backup to a separate location (including backup to the cloud);

• use as an ICT security measure: network access control (management of access by devices and users to the enterprise's network);

• use as an ICT security measure: VPN (Virtual Private Network, which extends the private network across a public network to enable secure exchange of data over public network);

• use as an ICT security measure: maintaining log files for analysis after security incidents;

• use as an ICT security measure: ICT risk assessment, i.e. periodically assessment of probability and consequences of ICT security incidents;

• use as an ICT security measure: ICT security tests such as performing penetration tests, testing security alert systems, reviewing security measures, testing backup systems;

• making persons employed aware of their obligations in ICT security related issues through voluntary training or internally available information (such as information on the intranet);

• making persons employed aware of their obligations in ICT security related issues through compulsory training courses or viewing compulsory material;

• making persons employed aware of their obligations in ICT security related issues through a contract (such as a contract of employment);

• ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by enterprise's own employees (including those employed in parent or affiliate enterprises);

• ICT security related activities such as security testing, ICT training on security, resolving ICT security incidents (excluding upgrades of pre-packaged software) carried out by external suppliers;

• availability of document(s) on measures, practices or procedures on ICT security;

• problems experienced at least once in the previous calendar year due to ICT related incidents: unavailability of ICT services, for example denial of service attacks, ransomware attacks, hardware or software failures excluding mechanical failure, theft;

• problems experienced at least once in the previous calendar year due to ICT related incidents: destruction or corruption of data, for example due to infection of malicious software or unauthorised intrusion, hardware or software failures;

• problems experienced at least once in the previous calendar year due to ICT related incidents: disclosure of confidential data, for example due to intrusion, pharming, phishing attack, actions by enterprise's own employees (intentionally or unintentionally);

• availability of an insurance against ICT security incidents;

for enterprises having document(s) on measures, practices or procedures on ICT security:

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: management of access rights for the usage of ICT, such as computers, network;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: storage, protection, access or processing of data;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: procedures or rules to prevent or respond to security incidents, such as pharming, phishing attacks, ransomware;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: responsibility, rights and duties of persons employed in the field of ICT, such as use of e-mails, mobile devices, social media;

• (optional) document(s) on measures, practices or procedures on ICT security in the enterprise addressing: training of persons employed in the safe usage of ICT;

• most recent definition or review of enterprise's document(s) on measures, practices or procedures on ICT security (such as risk assessment, evaluation of ICT security incidents): within the last 12 months; more than 12 months and up to twenty-four months ago; more than twenty-four months ago.