11.1 Access control policy

Requirement

For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network and information system security requirements.

Guidance

• Implement and maintain logical and physical access restrictions to network and information system based on access-control policies that take into account industry good practices.
• Ensure that these policies are documented, communicated to all relevant stakeholders and include clear guidelines on the appropriate use of access privileges.

Examples of evidence

• Access control policy document or documents outlining the access control requirements, procedures and responsibilities.

Requirement

The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff, visitors and external entities such as suppliers and service providers; (b) address access by network and information system processes; (c) ensure that access is only granted to users that have been adequately authenticated.

Guidance

• Implement access control rules by defining and mapping appropriate access rights and restrictions to human users or network and information system processes (e.g. a machine, device or a service). To simplify access control management, assign specific roles to groups.
  • Access control rules can be implemented in different granularities, ranging from covering whole networks or systems to specific data fields and can also consider properties, such as user location or the type of network connection that is used for access.
  • Use business requirements and risk assessment results to define which access control rules are applied and which granularity is required.
• Take into account the following when defining and implementing access control rules:
  • consistency between access rights and asset classification;
  • consistency between access rights and physical perimeter security needs and requirements;
  • consideration of all types of available connections in distributed environments so entities are only provided with access to associated assets, including networks and network services, that they are authorized to use;
  • consideration of how elements or factors relevant to dynamic access control can be reflected.
• Develop documented procedures and defined responsibilities to support the access control rules.

Examples of evidence

• Access control policy document outlining the access control requirements, procedures and responsibilities.
• User access records showing the list of users and their corresponding levels of access to various network and information systems.
• Authentication protocols, meaning documentation of the authentication methods in place, such as MFA.
• Authorization mechanisms with details on how permissions are granted, reviewed and revoked, ensuring that access rights are in line with users’ roles, responsibilities and authorities.
• Access logs that record user access activities, which can be used to track and audit user behaviour within the system in the event of suspected misconduct.
• Access rights review records showing alignment with asset classifications.
• Records of access control assessments that align access rights with physical security requirements.
• Network diagrams showing access control measures for different connection types and network access control policies.
• Logs showing dynamic access control decisions based on user behaviour or environment factors

Requirement

The relevant entities shall review and, where appropriate, update the policies at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

• Review the policies at least annually.

Examples of evidence

• Past incident reports with records of any security incidents related to access control, including unauthorized access attempts and the responses to such events.
• Change management records of any changes made to access rights, showing adherence to the policy during modifications.
• Records of reviews and updates showing that the policies are reviewed regularly and updated as necessary.
• Reports from internal or external audits that assess the effectiveness of and compliance with the access control policy.

Tips: guidance

• Consider the two overarching principles most frequently used in the context of access control:
  • need-to-know: an entity is only granted access to the information that it requires to perform its tasks and in line with the asset classification levels of point 12.1 of the Annex to the regulation (different tasks or roles mean different need-to-know information and hence different access profiles);
  • need-to-use: an entity is only assigned access to information technology infrastructure where a clear need is present.
• Consider the following when specifying access control rules:
  • establishing rules based on the premise of least privilege (‘everything is generally forbidden unless expressly permitted’) rather than the weaker rule (‘everything is generally permitted unless expressly forbidden’);
  • changes in user permissions that are initiated automatically by the network and information system and those initiated by a system administrator;
  • when to define and regularly review the approval.
• Consider ways to implement access control, such as mandatory access control (MAC), discretionary access control (DAC), role-based access control (RBAC) and attribute-based access control (ABAC) depending on the business needs of the organisation.
• Take into account the fact that access control rules can also contain dynamic elements (e.g. a function that evaluates past accesses or specific environmental values).

Tips: examples of evidence

• Access control policy document outlining the access control requirements, procedures and responsibilities.
• Access reviews showing adherence to need-to-know and need-to-use principles.
• Change management records of any changes made to access rights, showing adherence to the policy during modifications.
• Access control system configurations showing the adoption of MAC, DAC, RBAC or ABAC depending on business needs.