11.2 Management of access rights

Requirement

The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.

Requirement

The relevant entities shall: (a) assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties; (b) ensure that access rights are modified accordingly upon termination or change of employment; (c) ensure that access to network and information systems is authorised by the relevant persons; (d) ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration; (e) maintain a register of access rights granted; (f) apply logging to the management of access rights.

Guidance

• Ensure each user only has access to information necessary for their role (‘need-to-know’).
• Restrict user permissions to the minimum necessary for their duties (‘least privilege’). Regularly review and adjust access rights as needed.
• Determine which duties and areas of responsibility need to be segregated. Establish and follow a process for requesting and approving access, preferably automated. The process should:
  • cover granting access rights to assets upon the new hire or role change of a user;
  • obtain authorization from the owner of the asset, separate approval for access rights by management bodies can also be appropriate;
  • ensure that access rights are activated (e.g. by service providers) only after authorization procedures are successfully completed;
  • consider the business requirements and the entity’s access control policy;
  • consider segregation of duties, including segregating the roles of approval and implementation of the access rights and separation of conflicting roles;
  • verify that the level of access granted is in accordance with the access control policy and is consistent with other information security requirements such as segregation of duties;
  • consider giving temporary access rights for a time and revoking them at the expiry date, in particular for temporary personnel or temporary access required by personnel.
• Establish and follow a process, preferably automated, for revoking access to assets. The process should:
  • timely disable accounts upon the termination, rights revocation or role change of a user, as needed; disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails;
  • modify the access rights of users who have changed roles or jobs;
  • remove or adjust access rights, which can be done by removing, revoking or replacing keys, authentication information, identification cards or subscriptions.
  • where feasible, enable different components or services to share information (signals) about access revocation in a timely manner.
• Limit third-party access based on need and duration. Use temporary access accounts with expiry dates and regularly review third-party access rights.
• Ensure third parties acknowledge their access responsibilities and obligations.
• Where appropriate (90), keep a detailed and up-to-date central record (register or database) of all granted access rights, including user names, roles, permissions and dates of access changes.
• Establish and maintain an inventory of the authentication and authorization systems, including those hosted on-site or with a remote service provider.
• Implement logging for all access rights management activities. Logs should include details of who granted or modified access, when and what changes were made.
• Minimise the use of generic and shared accounts and ensure users can always be identified for their actions within ICT systems.

Examples of evidence

• Clear definitions of user roles and their corresponding access rights.
• A central record (register or database) detailing all granted access rights, including user names, roles, access levels and dates of access changes.
• Approved access request forms supporting entries in the access rights register. Granting, withdrawals and changes of access should be appropriately documented and visible in the register and consistent with the process for granting and withdrawing access rights (Annex to the regulation, point 11.2.2). It is also important that archived backups are properly secured to prevent unauthorised access. It should be remembered that in the case of these copies, excessive permissions should be limited and controlled.
• Periodic access reviews meaning evidence of regular reviews of user access rights to ensure they remain appropriate over time.
• System logs showing all access rights management activities (creation, modification and deletion).
• Audit trail logs demonstrating access rights management, including timestamps, user IDs and actions performed.
• Records of incidents related to access rights management, including unauthorized access attempts and corrective actions.
• Evidence of systems enforcing access controls, such as identity and access management (IAM) solutions.
• Reports from internal or external compliance audits verifying alignment with the access control policy.
• Results of physical inspections of access control systems and their use, if applicable.

Requirement

The relevant entities shall review access rights at planned intervals and shall modify them based on organisational changes. The relevant entities shall document the results of the review including the necessary changes of access rights.

Guidance

• Regularly review physical and logical access rights, taking into account:
  • users’ access rights after termination or change of employment;
  • authorisations for privileged access rights.
• Review and update the inventory of the authentication and authorization systems regularly.
• Perform access control reviews of assets to verify that all privileges are authorised on a recurring schedule at least annually.

Examples of evidence

• A central record (register or database) detailing all granted access rights, including user names, roles, access levels and dates of access changes.
• Approved access request forms supporting entries in the access rights register.
• Periodic access reviews meaning evidence of regular reviews of user access rights to ensure they remain appropriate over time.
• System logs showing all access rights management activities (creation, modification and deletion).
• Audit trail logs demonstrating access rights management, including timestamps, user IDs and actions performed.
• Records of incidents related to access rights management, including unauthorized access attempts and corrective actions.
• Reports from internal or external compliance audits verifying alignment with the access control policy.
• Physical inspection results of access control systems and their use, if applicable.
• Records of reviews and updates showing that access rights are reviewed regularly and updated as necessary.

Tips: guidance

• Centralize access control for all assets through a directory service or single sign on (SSO) provider, where supported.
• Implement a segregation of duties matrix and ensure that it is updated dynamically by automating how changes are handled in response to role assignments or task changes (e.g. integration with access control, IAM or enterprise resource planning (ERP) systems).

Tips: examples of evidence

• Evidence of a centralized directory service or SSO provider to manage access control, supported by documentation, logs, audit reports and records.
• Segregation of duties matrix.