11.5.2 For that purpose, the relevant entities shall: (a) set up unique identities for network and …

Requirement

For that purpose, the relevant entities shall: (a) set up unique identities for network and information systems and their users; (b) link the identity of users to a single person; (c) ensure oversight of identities of network and information systems; (d) apply logging to the management of identities.

Guidance

• Consider that providing or revoking access to assets is usually a multi-step procedure:
  • confirming the business requirements for an identity to be established;
  • verifying the identity of an entity before allocating them a logical identity;
  • establishing an identity;
  • configuring and activating the identity, which also includes configuration and initial setup of related authentication services; and
  • providing or revoking the identity’s specific access rights, based on appropriate authorization or entitlement decisions (section 11.2).
• Make sure that identities assigned to network and information systems (non-human users) are subject to appropriately segregated approval and independent ongoing oversight.
• Apply logging to the management of identities in cooperation with human resource security (section 10.1) where possible.

Examples of evidence

• Identity records, for example user profiles with unique identifiers (e.g. usernames and employee IDs) and evidence of linking these identities to specific individuals (e.g. HR records).
• Logs of reviews or approvals for identities for network and information systems and their users.
• Logs or reports related to identity management.
• Evidence of the systems in place that enforce access control, such as IAM solutions.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.