+11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …

11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …

Requirement

The relevant entities shall review access rights of privileged accounts and system administration accounts at planned intervals and be modified based on organisational changes and shall document the results of the review, including the necessary changes of access rights.

Guidance

  • Verify whether the duties, roles, responsibilities and competences of system administrators still qualify them for working with privileged access rights.

Examples of evidence

  • Records of reviews and updates showing that access rights are reviewed regularly and updated as necessary.
  • Periodic access reviews meaning evidence of regular reviews of user access rights to ensure they remain appropriate over time.
  • Change management logs of changes to access rights, reflecting any alterations due to role changes or termination of employment.
  • Compliance audits with reports from internal or external audits verifying that the management of access rights aligns with the policy and regulatory requirements.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is related to 11.3.3. De relevante enheder gennemgår adgangsrettighederne til privilegerede konti og …
  • ENISA -

    EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

    DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.