|
+Policy for user accounts and access rights |
Policy for user accounts and access rightsA role and rights concept based on the business and security requirements of the Cloud Service Provider as well as a policy for managing user accounts and access rights for internal and external employees of the Cloud Service Provider and system components that have a role in automated authorisation processes of the Cloud Service Provider are documented, communicated and made available according to SP-01:• Assignment of unique usernames; • Granting and modifying user accounts and access rights based on the “least • Segregation of duties between operational and monitoring functions (“Segregation of Duties”); • Segregation of duties between managing, approving and assigning user accounts and access rights; • Approval by authorised individual(s) or system(s) for granting or modifying user accounts and access rights before data of the cloud customer or system components used to provision the cloud service can be accessed; • Regular review of assigned user accounts and access rights; • Blocking and removing access accounts in the event of inactivity; • Time • Two • Requirements for the approval and documentation of the management of user accounts and access rights. Additonal Criteria- Supplementary Information - About the CriteriaSystem components in the sense of the basic criterion cf. definition in OPS-23. Automated authorisation processes in the sense of this basic criterion concern procedures for automated software provisioning (continuous delivery) as well as for automated provisioning and deprovisioning of user accounts and access rights based on approved requests. 1. Übersicht
1.1 Referenzen1.2 Identifizierte Anforderungen1.3 Zugehörige Regulierungen2. Identifizierte Anforderungen
3. Zugehörige Regulierungen
|