Requirement
The cybersecurity requirements for email service must be reviewed periodically.
Control Implementation Guidelines
- Review the implementation of cybersecurity requirements for email protection by conducting a periodic assessment (according to a documented and approved plan for review, and based on a planned interval "e.g., quarterly") to implement the organization's email protection procedures by the Cybersecurity function and in cooperation with relevant departments (such as IT Department)
- Conduct application review through traditional channels (e.g., email) or automated channels using a compliance management system. The organization may develop a review plan explaining the cybersecurity requirements implementation review schedule for email protection
- Review and update Cybersecurity requirements for email protection in the organization must be reviewed and updated periodically according to a documented and approved plan for review and based on a planned interval or in the event of changes in relevant laws and regulations
- Document the review and changes to the cybersecurity requirements for email protection in the organization and approve them by the head of the organization or his/her deputy
Expected Deliverables
- Results of email protection cybersecurity requirements implementation review in the organization
- A document that defines the cybersecurity requirements application review cycle for the organization's email protection (Compliance Assessment Schedule)
- Compliance assessment report that outlines the assessment of the implementation of cybersecurity requirements for the organization's email protection
- An approved document that sets the policy's review schedule
- Policy indicating that it has been reviewed and updated, and that changes have been documented and approved by the head of the organization or his/her deputy
- Formal approval by the head of the organization or his/her deputy on the updated policy (e.g., via the organization's official e-mail, paper or electronic signature)
