Citations: CISA Security Requirements for Restricted Transactions

1 - Organizational- and System-Level Requirements

1.A - Organizational Cybersecurity (policies, practices and requirements)

1.A.1 - Asset Inventory

1.A.2 -Chief Information Security Officer

1.A.3 - Vulnerability Management

1.A.4 - Vendor / Supplier Agreements

1.A.5 - Network Architecture Diagrams

1.A.6 - Policy for HW and SW risk

1.A.7 - Security Incident Response Plan

1.B - Logical and Physical Access Controls

1.B.1 - Secure Login (MFA or complex passwords)

1.B.2 - Identify Lifecycle Mgmt Process (movers and leavers)

1.B.3 - Log Collection (access & security events)

1.B.4 - Network Security (deny by default)

1.B.5 - Identity and Access Mgmt (least privilege principle)

1.C - Data Risk Assessment (System Risk Assessment)

2 - Data-Level Requirements

2.A - Data Minimization and Data Masking Strategies

2.A.1 - Data Retention and Deletion Policy

2.A.2 - Minimize Linkability (anonymize, pseudonymize, aggregate, de-identify)

2.B - Encryption Techniques

2.B.1 - Encrypt Data in Transit and at Rest

2.B.2 - Key Management

2.C - Privacy Enhancing Technologies (PET)

2.C.1 - Apply PETs (privacy preserving tech, differential privacy)

2.D - Deny All Access (authorized & unauthorized) if unable to mitigate risks