|
+Privileged access rights |
Privileged access rightsPrivileged access rights for internal and external employees as well as technical users of the Cloud Service Provider are assigned and changed in accordance to the policy for managing user accounts and access rights (cf. IDM-01) or a separate specific policy.Privileged access rights are personalised, limited in time according to a risk assessment and assigned as necessary for the execution of tasks ("need Activities of users with privileged access rights are logged in order to detect any misuse of privileged access in suspicious cases. The logged information is automatically monitored for defined events that may indicate misuse. When such an event is identified, the responsible personnel are automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action. In the event of proven misuse of privileged access rights, disciplinary measures are taken in accordance with HR-04. Additonal Criteria- Supplementary Information - About the CriteriaPrivileged access rights in the sense of the Basic Criterion are those that enable employees of the Cloud Service Provider to perform any of the following activities: • Read or write access to the cloud customers' data processed, stored or transmitted in the cloud service, unless such data is encrypted or the encryption can be deactivated for access by the Cloud Service Provider; and • Changes to the operational and/or security configuration of the system components in the production environment, in particular the starting, stopping, deleting or deactivating of system components, if this can affect the confidentiality, integrity or availability of the data of the cloud customers (also indirectly, e.g. by deactivating the logging and monitoring of security 1. Přehled
1.1 Odkazy1.2 Identifikované požadavky1.3 Související regulace2. Identifikované požadavky
3. Související regulace
|