Kibernetinio saugumo reikalavimų aprašas (KSRA)
Human Resources Security, Physical Access Policy and Asset Management
58. The head of the cybersecurity entity or a person authorised by them must establish human resources security requirements covering:
- 58.1. the requirement that access to the cybersecurity entity's network and information system be granted to the entity's employees and/or service providers only after they have read the cybersecurity policy documents and agreed to comply with them
- 58.2. confidentiality or non-disclosure requirements for the cybersecurity entity's employees and/or service providers.
59. The head of the cybersecurity entity or a person authorised by them must approve physical access requirements for network and information systems, covering:
- 59.1. a list of the premises that must be protected (premises housing the cybersecurity entity's network and information systems equipment, servers, and the workstations of users and administrators)
- 59.2. the physical environment protection and access control measures applied to the protected premises
- 59.3. the requirement that only authorised persons may enter the cybersecurity entity's protected premises
- 59.4. the appointment of persons responsible for implementing the physical security measures.
60. The technical requirements applicable to cybersecurity entities are set out in Table 5.
51. The network and information system server rooms and the premises where backup data copies are stored must be protected against unauthorised entry by applying physical or electronic security measures.
52. Entry to the network and information system server rooms and to the premises where backup data copies are stored must be controlled in accordance with the procedure established by the cybersecurity entity.
61. The head of the cybersecurity entity or a person authorised by them must establish an asset management procedure for the entity, covering:
- 61.1. the requirement to draw up and keep up to date a list of the network and information systems assets (hardware, software and data managed by the cybersecurity entity) underpinning the entity's business functions (hereinafter — the asset list)
- 61.2. requirements for classifying assets according to their importance in terms of confidentiality, integrity and availability
- 61.3. requirements for moving assets outside the cybersecurity entity
- 61.4. requirements for the use of portable and removable data media
- 61.5. requirements for the secure use and control of mobile devices that can operate independently and connect to a network or the internet as their location changes (for example, a laptop, a handheld device, a smartphone) and that are used to connect to the network and information systems of cybersecurity entities.
62. Maintenance and fault repair of the network and information system equipment must be carried out by qualified specialists.
63. Faults in the network and information systems hardware must be logged.
64. The technical requirements applicable to cybersecurity entities are set out in Table 6.
All cybersecurity entities
53. Technical measures are used that restrict the connection of unauthorised devices (not included in the asset list) to the cybersecurity entity's network and information systems, restrict the use of unauthorised hardware, and notify the person authorised by the entity.
54. The cybersecurity entity must centrally manage the mobile devices that have access to the network and information systems, and the software installed on them.
<...>
57. Requirements for the hardware and software of the network and information system and for the premises:
- 57.1. network and information systems computer equipment assessed by the cybersecurity entity as important must have a surge filter and an uninterruptible power supply ensuring the operation of the hardware;
- 57.2. where the total power of the equipment located in the network and information systems server rooms exceeds 10 kilowatts, air conditioning equipment must be installed;
<...>
- 57.4. the hardware and software of the network and information system must be maintained in accordance with the manufacturer's recommendations;
- 57.5. fire and intrusion detectors must be installed in the network and information system server rooms and connected to the building alarm system and/or the monitoring console of the security service;
<...>
Additionally, only for Essential cybersecurity entities
55. Mobile devices used to browse the internet must be protected against threats posed by mobile code.
56. Mobile devices must have measures installed that make it possible to erase the data on them remotely and irrecoverably.
57. Requirements for the hardware and software of the network and information system and for the premises:
- 57.3. server rooms must have air conditioning and humidity control equipment;
- 57.6. fire detectors and/or other physical security measures must be installed in all premises housing the cybersecurity entity's hardware;
- 57.7. critical elements (air conditioning equipment, ventilation and humidity control, electricity supply) must be duplicated in order to ensure the high reliability of the equipment necessary for operating the premises.