ACP 122 (F) - Multilateral Planners Conference

UNCLASSIFIED
ACP 122(F)
b. Dial-In/Out Accounts. Users should be briefed on the security problems inherent
in providing dial-in access. Such connections should be used only on a strictly
mission-critical basis and when no other type of connections are available,
c. Privileged Accounts. Access to privileged user accounts should be monitored,
and only used when needed; unless the privileges are needed all the time, the user
should be encouraged to have a 2 nd , standard account for routine use,
d. Operating System Software Configuration. Users shall not modify the
operating system software configuration without the consent of the ISSO or the
Information Systems (IS) Manager,
e. Detection and Surveillance - Audit Records. All security relevant-events, as
defined by national policy, shall be recorded in audit records,
f. Remote Diagnostics. Remote diagnostics should not normally be provided for
Classified CIS,
g. Malicious Software. A malicious software strategy shall be maintained. All data
shall be checked on export. The requirements for handling malicious software, as
laid down at Chapter 14, should be known by all users,
h. Import of Information. The import of all information into an IT system from any
source, either by media or a network connection to an external system, is to be
approved in accordance with operating procedures. It is also to be legally acquired
and used in accordance with the licence agreement,
i. Handling and Marking of Electronic Storage Media. All types of removable
electronic storage media are to be labelled, handled, accounted for, de-classified or
re-classified, and disposed of, in accordance with their security classification,
j. On-site Maintenance of Classified Hardware and Media. If classified assets of
a Defence information system are maintained on-site, the maintainer is to either
hold a security authorisation and/or clearance at the appropriate level, or be
escorted by someone who is authorised and/or cleared, and
k. Off-Site Repair of Classified Hardware and Media. If classified assets of an
information system are repaired off-site, the removal and repair of the media is to
be in accordance with (i) above.
11-2 Original
UNCLASSIFIED
(Reverse Blank)