Search

By number By text StandardPublic Safety & Disaster

Categories (match all selected)Network Operators Service Providers Equipment Suppliers Property Managers Public Safety Government Cable Internet/Data Satellite Wireless Wireline Access Control Buildings Business Continuity Contractors & Vendors Corporate Ethics Cyber Security Disaster Recovery Documentation Emergency Preparedness Essential Services Facilities-Transport Fire Guard Services Hardware Human Resources Industry Cooperation Information Protection Liaison Materials Movement Network Design Network Elements Network Interoperability Network Operations Network Provisioning Pandemic Physical Security Management Policy Power Procedures Public Safety Service Security Systems Software Supervision Technical Support Training and Awareness Visitors Encryption Intrusion Detection

1098 matching practices

Number	Best Practice
13-9-5227	Network Operators, Service Providers, Equipment Suppliers, Property Managers, and Public Safety should perform after-action reviews of emergency response and restoration of major events to capture lessons learned (e.g., early warning signs) and to enhance emergency response and restoration plans accordingly. A process similar to NRIC VII, Focus Group 2B Report Appendices Appendix Z “Recovery Incident Response (IR) Post Mortem Checklist” can be used to capture and identify countermeasures to prevent or mitigate the impact of future incidents and to quickly and effectively restore service from such events in the future.
13-9-5228	Network Operators, Service Providers, and Equipment Suppliers should consider including cross-subsidiary (e.g. A LEC and its Wireless Business Unit) resource sharing and communications in business continuity plans to support emergency response and restoration.
13-9-5231	Network Operators, Service Providers, Equipment Suppliers, Property Managers, and Public Safety should develop documentation for the restoration of power for areas of critical infrastructure including such things as contact information, escalation procedures, restoration steps and alternate means of communication. This documentation should be maintained both on-site and at centralized control centers.
13-9-5232	Network Operators, Service Providers, Property Managers, and Public Safety should test fuel reserves used for standby or backup power for contamination at least once a year or after any event (e.g., earth tremor, flood) that could compromise the integrity of the tank housing, fill pipe or supply pipe.
13-9-5234	Network Operators, Service Providers, Property Managers, and Public Safety should provide or arrange for security to protect temporary equipment placements and staging areas for critical infrastructure equipment in a disaster area.
13-9-5237	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should verify the integrity of system spares and replenish spares, as appropriate, as part of a disaster response and at the conclusion of a disaster response at a facility.
13-9-5240	Network Operators, Service Providers, Equipment Suppliers, Property Managers, and Public Safety should have a plan for responding to malfunctioning access control equipment to include determining restoration priorities for failed security systems after an event.
13-9-5258	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should define and assign responsibility for retrieval of all corporate assets (e.g., access cards, equipment) and ensure temporary physical and logical access is removed after completion of a restoration effort for all temporary personnel associated with the restoration.
13-9-5259	Network Operators, Service Providers, Equipment Suppliers, Property Managers, and Public Safety should establish and enforce access control and identification procedures for all individuals (including temporary contractors, and mutual aid workers) at restoration sites for which they have responsibility. Provide for issuing and proper displaying of ID badges and the sign-in and escorting procedures, where appropriate.
13-9-5281	Network Operators, Service Providers, Property Managers and Public Safety should design, install and maintain each generator as a standalone unit, for buildings serviced by more than one emergency generator, that is not dependent on the operation of another generator for proper functioning, including fuel supply path.
13-9-8008	Network Operators, Service Providers, and Public Safety should implement architectures that partition or segment networks and applications using means such as firewalls, demilitarized zones (DMZ), or virtual private networks (VPN) so that contamination or damage to one asset does not disrupt or destroy other assets. In particular, where feasible, it is suggested user traffic networks, network management infrastructure networks, customer transaction system networks, and enterprise communication/business operations networks be separated and partitioned from one another.
13-9-8018	Network Operators, Service Providers and Equipment Suppliers should for OAM&P applications and interfaces, harden the access control capabilities of each network element or system before deployment to the extent possible (typical steps are to remove default accounts, change default passwords, turn on checks for password complexity, turn on password aging, turn on limits on failed password attempts, turn on session inactivity timers, etc.). A preferred approach is to connect each element or system's access control mechanisms to a robust AAA server (e.g., a RADIUS or TACAS server) with properly hardened access control configuration settings.
13-9-8019	Network Operators, Service Providers, and Equipment Suppliers should have operating system hardening procedures applied with devices equipped with operating systems used for OAM&P. Harding procedures include (a) all unnecessary services are disabled; (b) all unnecessary communications pathways are disabled; (c) all critical security patches have been evaluated for installations on said systems/applications; and d) review and implement published hardening guidelines, as appropriate. Where critical security patches cannot be applied, compensating controls should be implemented.
13-9-8030	Network Operators, Service Providers, Equipment Suppliers, and Public Safety should use session timers for all Operations, Administration, Maintenance, and Provisioning (OAM&P) applications, systems, and interfaces to disconnect, terminate, or logout authenticated sessions that remain inactive past some preset (but ideally configurable by the Administrator) time limit that is appropriate for operational efficiency and security.
13-9-8032	Network Operators, Service Providers, and Equipment Suppliers should design and deploy a patching process based on industry recommendations, especially for critical OAM&P systems.
13-9-8034	Network Operators and Service Providers should define and incorporate a formal patch/fix policy into the organization's security policies.
13-9-8035	Network Operators, Service Providers, and Public Safety should include steps to appropriately test all patches/fixes in a test environment prior to distribution into the production environment in their patch/fix policy and process guidelines.
13-9-8037	Network Operators, Service Providers, and Public Safety should maintain a complete inventory of elements to ensure that patches/fixes can be properly applied across the organization. This inventory should be updated each time a patch/fix is identified and action is taken.
13-9-8038	Network Operators and Service Providers should have a formal process during system or service development that exist in which a review of security controls and techniques is performed by a group independent of the development group, prior to deployment.
13-9-8039	Service Providers, Network Operators, and Public Safety should perform a verification process to ensure that patches/fixes are actually applied as directed throughout the organization. Exceptions should be reviewed and the proper patches/fixes actually applied.

Download matching Best Practices

Next results