11.1.3 The relevant entities shall review and, where appropriate, update the policies at planned intervals …

Requirement

The relevant entities shall review and, where appropriate, update the policies at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Review the policies at least annually.

Examples of evidence

• Past incident reports with records of any security incidents related to access control, including unauthorized access attempts and the responses to such events.
• Change management records of any changes made to access rights, showing adherence to the policy during modifications.
• Records of reviews and updates showing that the policies are reviewed regularly and updated as necessary.
• Reports from internal or external audits that assess the effectiveness of and compliance with the access control policy.

Tips: guidance

• Consider the two overarching principles most frequently used in the context of access control:
  • need-to-know: an entity is only granted access to the information that it requires to perform its tasks and in line with the asset classification levels of point 12.1 of the Annex to the regulation (different tasks or roles mean different need-to-know information and hence different access profiles);
  • need-to-use: an entity is only assigned access to information technology infrastructure where a clear need is present.
• Consider the following when specifying access control rules:
  • establishing rules based on the premise of least privilege (‘everything is generally forbidden unless expressly permitted’) rather than the weaker rule (‘everything is generally permitted unless expressly forbidden’);
  • changes in user permissions that are initiated automatically by the network and information system and those initiated by a system administrator;
  • when to define and regularly review the approval.
• Consider ways to implement access control, such as mandatory access control (MAC), discretionary access control (DAC), role-based access control (RBAC) and attribute-based access control (ABAC) depending on the business needs of the organisation.
• Take into account the fact that access control rules can also contain dynamic elements (e.g. a function that evaluates past accesses or specific environmental values).

Tips: examples of evidence

• Access control policy document outlining the access control requirements, procedures and responsibilities.
• Access reviews showing adherence to need-to-know and need-to-use principles.
• Change management records of any changes made to access rights, showing adherence to the policy during modifications.
• Access control system configurations showing the adoption of MAC, DAC, RBAC or ABAC depending on business needs.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -