IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities

The cloud service provider has a risk-based procedure in place for managing identities (cf. IAM-01), taking into account the types of data accessible via the identities of the internal and external personnel.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

As part of this procedure, specific parameters for automatically locking and withdrawing access due to inactivity or indications of brute force attacks are defined, with exceptions for the identities whose use is restriced to emergency recovery and similar scenarios.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

Locking can result from a longer absence of the personnel, for example, due to illness, parental leave, or sabbatical. Multiple failed login attempts can be indications of brute force attacks.

The cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider that have privileged access rights.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

This process can be performed automatically, or manually by authorised personnel.

The aforementioned process includes an exception mechanism to be applied if all identities needed to manage the situation are potentially compromised.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

This exception mechanism should be implemented as part of the business continuity and emergency management system (cf. BCM-01), as cases where all identities needed to manage the situation described in IAM-03.03B are potentially compromised constitute an emergency.

The context of authentication attempts is monitored and suspicious events are, as relevant, flagged to authorised persons.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

The context of an authentication attempt can, but does not have to, include IP addresses, the date and time, or the device used.

The effectiveness of the procedures for locking and withdrawing identities is validated.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Timely and appropriate remediation measures address any deviations identified during validation.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

The cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

This process can be performed automatically, or manually by authorised personnel.