|
+PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of … |
PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of …StatementAccess permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties GuidanceReview logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed GuidanceTake attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health) GuidanceRestrict access and privileges to the minimum necessary (e.g., zero trust architecture) GuidancePeriodically review the privileges associated with critical business functions to confirm proper separation of duties 1. Přehled
1.1 Odkazy1.2 Identifikované požadavky1.3 Související regulace2. Identifikované požadavky
3. Související regulace
Propojené úkoly |