SSH
Service must be set up to use only one TCP/IP port;
TCP/IP port must be different from standard (22). The number must contain two, three or four digits and must not be used by any other service.
Service access password must contain both Latin letters and numbers, its minimal length is six symbols;
Service access password must be changed at least one time in six months.
MySQL
MySQL server must listen one IP address, namely loopback IP.
Service access password must contain both Latin letters and numbers, its minimal length is six symbols.
General rules
Access passwords for SSH and MySQL services must be known only to personnel who maintain the System at the level where such access is required and according to terms and conditions of the Contract.