+11. Access control
---+11.1 Access control policy
------+11.1.1 For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities …
------+11.1.2 The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff …
------+11.1.3 The relevant entities shall review and, where appropriate, update the policies at planned intervals …
---+11.2 Management of access rights
------+11.2.1 The relevant entities shall provide, modify, remove and document access rights to network and …
------+11.2.2 The relevant entities shall: (a) assign and revoke access rights based on the principles of …
------+11.2.3 The relevant entities shall review access rights at planned intervals and shall modify them based …
---+11.3 Privileged accounts and system administration accounts
------+11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …
------+11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …
------+11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …
---+11.4 Administration systems
------+11.4.1 The relevant entities shall restrict and control the use of system administration systems in …
------+11.4.2 For that purpose, the relevant entities shall: (a) only use system administration systems for …
---+11.5 Identification
------+11.5.1 The relevant entities shall manage the full life cycle of identities of network and information …
------+11.5.2 For that purpose, the relevant entities shall: (a) set up unique identities for network and …
------+11.5.3 The relevant entities shall only permit identities assigned to multiple persons, such as shared …
------+11.5.4 The relevant entities shall regularly review the identities for network and information systems and …
---+11.6 Authentication
------+11.6.1 The relevant entities shall implement secure authentication procedures and technologies based on …
------+11.6.2 For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …
------+11.6.3 The relevant entities shall to the extent feasible use state-of-the-art authentication methods, in …
------+11.6.4 The relevant entities shall regularly review the authentication procedures and technologies at …
---+11.7 Multi-factor authentication
------+11.7.1 The relevant entities shall ensure that users are authenticated by multiple authentication factors …
------+11.7.2 The relevant entities shall ensure that the strength of authentication is appropriate for the …
|
11. Access control
Access control
1. Overview
| Summary |
Standard |
|
11.1 Access control policy
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.5.15, A.7.2, Α.8.3, Α.8.21 | | NIST Cybersecurity Framework v2.0 | PR.AA-05, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04 | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-02X, REQ-7.4-09X, REQ-7.4-13X, REQ-7.4-01, REQ-7.4-06X, REQ-7.4-11X, REQ-7.4-20X | | CEN/TS 18026:2024 | OIS-02, ISP-02, IAM-01 | | BE-CyFun®2023 | BASIC: ID.AM-5.1, ID.GV-1.1, PR.AC-4.1, PR.IP-11.1
IMPORTANT: ID.AM-6.1, ID.GV-1.2, PR.AC-2.2, PR.AC-4.6, PR.AC-5.4, PR.AC-6.1, PR.AT-3.2, PR.DS-3.3, PR.DS-5.1, PR.IP-11.2, PR.MA-2.1, DE.AE-3.2, DE.CM-3.3, DE.CM-6.1, DE.CM-7.1
ESSENTIAL: PR.DS-1.1, PR.DS-3.3, DE.CM-2.2 | | FI-Kybermittari | ACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-3 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 13a, 13h
Cybersecurity Handbook: Part B: 4.1 | | ENS-Royal Decree 311/2022 | Article 12, Article 17, Article 18, Article 20
Annex II: [op.acc] Access control, [org.1] Security policy, [org.2] Security regulations, [org.3] Security procedures, [org.4] Authorization process | | FR | 2.B.5-IE/EE
2.C.1-IE/EE
2.C.2-IE/EE
4.4-IE/EE |
|
|
11.2 Management of access rights
|
Mapping to standards and frameworks| ISO standard 27001:2022 | A.5.3, Α.5.18 | | NIST Cybersecurity Framework v2.0 | PR.AA-05, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04 | | ETSI Standard EN 319 401 V3.1.1 | Clause 7.4, REQ-7.9.1-04X | | CEN/TS 18026:2024 | OIS-02, IAM-04, IAM-05, PSS-03, HR-05 | | BE-CyFun®2023 | BASIC: ID.AM-5.1, ID.GV-1.1, PR.AC-1.1, PR.AC-4.3, PR.IP-11.1
IMPORTANT: ID.AM-6.1, ID.GV-1.2, PR.AC-2.2, PR.AC-6.1, PR.AT-3.2, PR.DS-5.1, PR.IP-11.2, PR.MA-2.1, DE.CM-6.1, DE.CM-7.1
ESSENTIAL: PR.DS-1.1 | | FI-Kybermittari | ACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-3, WORKFORCE-1, SITUATION-1, SITUATION-2 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 13b, 13c, 13e, 13h
Cybersecurity Handbook: Part B: 4.3, 4.6, 4.7, 4.8, 2.11, 2.14, 9.9
Self-assessment tool: 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 5.9, 5.13, 5.14 | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.2] Access requirements, [op.acc.3] Segregation of functions and tasks, [op.acc.4] Access rights management process, [op.acc.5] Authentication mechanism (external users), [op.acc.6] Authentication mechanism (organization users) | | FR | 6.1-IE/EE
6.2-EE
6.3-EE
6.4-EE
6.5-IE/EE
10.A.1-IE/EE
10.1.2-IE/EE
10.A.3-IE/EE
10.A.4-IE/EE
10.A.5-IE/EE
10.B.1-IE/EE
10.B.2-IE/EE
10.B.3-IE/EE
10.B.4-IE/EE
10.B.5-IE/EE
10.B.6-IE/EE
10.B.7-EE
10.C.1-IE/EE
10.C.2-IE/EE
10.C.3-IE/EE
10.C.4-IE/EE
11.A.7-EE |
|
|
11.3 Privileged accounts and system administration accounts
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.8.2, A.8.18 | | NIST Cybersecurity Framework v2.0 | ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04 | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-10X | | CEN/TS 18026:2024 | ISP-02, IAM-05, IAM-06 | | BE-CyFun®2023 | BASIC: PR.AC-1.1, PR.AC-4.3
IMPORTANT: PR.AC-4.7, PR.AT-2.1
ESSENTIAL: PR.AC-4.9 | | FI-Kybermittari | ACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-3 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 13b, 13d, 13h
Cybersecurity Handbook: Part B: 4.4, 4.5, 4.7
Self-assessment tool: 5.10, 5.11, 5.12, 5.13 | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.3] Segregation of functions and tasks | | FR | 4.5-IE/EE
11.A.1-IE/EE
11.A.2-IE/EE
11.A.3-IE/EE
11.A.4-EE
11.A.5-EE
11.A.6-EE
11.A.7-EE
11.B.3-EE
11.B.4-EE
19.2-EE
19.3-EE
19.4-EE
19.6-EE |
|
|
11.4 Administration systems
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.8.2, A.8.18 | | NIST Cybersecurity Framework v2.0 | - | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-10X, REQ-7.4-02X, REQ-7.4-03X, REQ-7.4-04X, REQ-7.4-05X, REQ-7.8-08, REQ-7.8-09X | | CEN/TS 18026:2024 | OIS-02, IAM-06, IAM-09 | | BE-CyFun®2023 | BASIC: PR.AC-4.4
IMPORTANT: PR.AC-5.4 | | FI-Kybermittari | ACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-2, ARCHITECTURE-3, ARCHITECTURE-5 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 13a, 13d | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.3] Segregation of functions and tasks | | FR | 7.A.1-IE/EE
7.A.4-EE
7.B.1-IE/EE
7.B.4-IE/EE
11.A.1-IE/EE
11.A.2-IE/EE
11.A.3-IE/EE
11.A.4-EE
11.A.5-EE
11.A.6-EE
11.A.7-EE |
|
|
11.5 Identification
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.5.16 | | NIST Cybersecurity Framework v2.0 | PR.AA-01, PR.AA-05, PR.AC-02 | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-11X, REQ-7.4-08X, REQ-7.4-12X, REQ-7.7-06X, REQ-7.9.1-04X | | CEN/TS 18026:2024 | IAM-02, IAM-03, IAM-06 | | BE-CyFun®2023 | BASIC: PR.AC-1.1, PR.AC-4.1
IMPORTANT: PR.AC-1.2, PR.AC-3.3, PR.AC-4.5, PR.AC-4.7, PR.AC-6.1
ESSENTIAL: PR.AC-4.9, PR.AC-6.2 | | FI-Kybermittari | ACCESS-1 | | EL- Ministerial decision 1689/2025 | Cybersecurity Handbook: Part B: 4.2, 4.3, 4.7
Self-assessment tool: 5.2, 5.6, 5.7, 5.13 | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.2] Access requirements, [op.acc.3] Segregation of functions and tasks, [op.acc.4] Access rights management process, [op.acc.5] Authentication mechanism (external users), [op.acc.6] Authentication mechanism (organization users); [mp.if.2] Identification of persons | | FR | 4.4-IE/EE
10.A.1-IE/EE
10.A.2-IE/EE
10.A.3-IE/EE
10.A.4-IE/EE
10.A.5-IE/EE
11.A.4-EE
11.A.5-EE
11.B.3-EE
11.B.4-EE |
|
|
11.6 Authentication
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.5.17 | | NIST Cybersecurity Framework v2.0 | PR.AA-05, PR.AA-03, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04 | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-02X, REQ-7.4-05X, REQ-7.7-06X, REQ-7.4-11X | | CEN/TS 18026:2024 | IAM-07, IAM-08 | | BE-CyFun®2023 | BASIC: PR.AC-3.2
IMPORTANT: PR.AC-1.2, PR.MA-2.2
ESSENTIAL: PR.AC-1.4, PR.AC-6.2 | | FI-Kybermittari | ACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-2, ARCHITECTURE-3, ARCHITECTURE-5 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: articles 13a, 13f, 13g, 13h
Cybersecurity Handbook: Part B: 5.1, 5.2, 5.3, 5.4, 5.5, 5.8, 5.10
Self-assessment tool: 6.1, 6.2, 6.6, 6.7, 6.8, 6.10 | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.2] Access requirements, [op.acc.3] Segregation of functions and tasks, [op.acc.4] Access rights management process, [op.acc.5] Authentication mechanism (external users), [op.acc.6] Authentication mechanism (organization users), [op.exp.2] Security Configuration | | FR | 4.4-IE/EE
8.1-IE/EE
8.2-IE/EE
8.3-EE
8.4-EE
8.5-EE
10.B.1-IE/EE
10.B.2-IE/EE
10.B.3-IE/EE
10.B.4-IE/EE
10.B.5-IE/EE
10.B.6-IE/EE
10.B.7-EE
19.10-EE |
|
|
11.7 Multi-factor authentication
|
Mapping to standards and frameworks| ISO standard 27001:2022 | Α.8.5 | | NIST Cybersecurity Framework v2.0 | PR.AA-03 | | ETSI Standard EN 319 401 V3.1.1 | REQ-7.4-05X, REQ-7.4-06X, ref. to clause 2 of CA/Browser Forum network security guide | | CEN/TS 18026:2024 | OPS-23, IAM-06, IAM-07 | | BE-CyFun®2023 | BASIC: PR.AC-3.2
IMPORTANT: PR.AC-1.2, ESSENTIAL: PR.AC-1.4 | | FI-Kybermittari | ACCESS1 | | EL- Ministerial decision 1689/2025 | Ministerial decision 1689/2025: article 13g
Cybersecurity Handbook: Part B: 5.6, 5.7, 5.9, 10.3
Self-assessment tool: 6.3, 6.4, 6.5, 6.9, 11.3 | | ENS-Royal Decree 311/2022 | Article 20
Annex II: [op.acc.1] Identification, [op.acc.2] Access requirements, [op.acc.3] Segregation of functions and tasks, [op.acc.4] Access rights management process, [op.acc.5] Authentication mechanism (external users), [op.acc.6] Authentication mechanism (organization users) | | FR | 8.1-IE/EE
8.2-IE/EE
8.3-EE
8.4-EE
8.5-EE
10.B.1-IE/EE
19.10-EE |
|
1.1 References
1.2 Identified Requirements
1.3 Related Regulations
2. Identified Requirements
Requirements
| Source |
Requirement |
3. Related Regulations
Regulations
| Source |
Regulation |
Linked Issues
|