+IND.1.A7 Establishing Comprehensive Authorisation Management Across OT and Office IT (S)

IND.1.A7 Establishing Comprehensive Authorisation Management Across OT and Office IT (S)

An organisation SHOULD establish a process for managing user access and assigned authorisations for OT. A corresponding authorisation management system SHOULD cover this process, along with the implementation and documentation of activities involved in applying for, configuring, and withdrawing authorisations.

The authorisation management system SHOULD ensure that authorisations are granted according to the minimum principle and checked at regular intervals. In the authorisation management system, access to IT systems SHOULD be regulated for employees, administrators, and third parties. Everyone involved SHOULD be made aware of the rules to be followed at regular intervals. Compliance SHOULD be checked. Misconduct SHOULD be sanctioned.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.32 Misuse of Authorisation
blocks G 0.36 Identity theft
blocks G 0.37 Repudiation of Actions