11.3.2. The policies referred to in point 11.3.1 shall: (a) establish strong identification …

(a)

establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;

(b)

set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;

(c)

individualise and restrict system administration privileges to the highest extent possible,

(d)

provide that system administration accounts are only used to connect to system administration systems.