Critical Controls: Summary
When correctly implemented, these Critical Controls can prevent, detect, or contain the majority of cyber attacks.
Ngā Tikanga Whakamaru Waiwai Critical Controls
When correctly implemented, our Critical Controls will prevent, detect, or contain the majority of the attacks we’ve seen in the past year.
Principle of least privilege
Make sure staff only have access to the networks and systems they need to do their job.
Patching
Keep software within your environment up to date, and understand the risk of delaying or cancelling patches and updates.
Password managers
Organisations should provide a password manager tool to all staff who have access to their systems and accounts.
Network separation and segmentation
Segmentation and separation can add an additional level of access control and security to the network, systems and data.
Multi-factor authentication and verification
This control requires users to provide additional verification when authenticating to critical business systems.
Implement and test backups
After an incident, restoring your data from backups is often the best way to return to business as usual.
Centralised logging
This control helps you store and secure your logs in a central place.
Build security awareness in your organisation
This control helps you build cyber security awareness in your organisation and create a positive security culture.
Asset lifecycle management
The intent of this control is to help organisations record, track, and maintain every system asset they use.
Application control
A set of security practices and controls designed to manage and restrict programs that run in your environment.