11.4.1 The relevant entities shall restrict and control the use of system administration systems in …

Requirement

The relevant entities shall restrict and control the use of system administration systems in accordance with the access control policy referred to in point 11.1.

Guidance

• Access to system administration systems must be strictly controlled in line with the access control policy. Only authorized personnel should be granted such access and all activity must be logged and regularly reviewed.
• Measures should be in place to detect unauthorized access and ensure accountability through audit trails and periodic security assessments.
• Access logs from system administration systems should be integrated into the entity's centralized log management or SIEM solution. Automated alerts must be configured to detect and notify of any suspicious or unauthorized access attempts, ensuring a timely response and ongoing compliance with security policies.
• The retention period for logs must be clearly defined based on business needs, legal requirements and network and information security objectives.
• Logs should capture relevant events necessary for security monitoring, incident detection and forensic analysis, such as access attempts, administrative actions and system changes.

Examples of evidence

• Regularly maintained logs that track access to system administration systems (93).
• Audit reports from internal or external security audits that assess compliance with the policy.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.