+11.3 Privileged accounts and system administration accounts
---+11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …
---+11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …
---+11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …

11.3 Privileged accounts and system administration accounts

Mapping to standards and frameworks

ISO standard 27001:2022Α.8.2, A.8.18
NIST Cybersecurity Framework v2.0ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-7.4-10X
CEN/TS 18026:2024ISP-02, IAM-05, IAM-06
BE-CyFun®2023BASIC: PR.AC-1.1, PR.AC-4.3
IMPORTANT: PR.AC-4.7, PR.AT-2.1
ESSENTIAL: PR.AC-4.9
FI-KybermittariACCESS-1, ACCESS-2, ACCESS-3, ACCESS-4, ARCHITECTURE-3
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 13b, 13d, 13h
Cybersecurity Handbook: Part B: 4.4, 4.5, 4.7
Self-assessment tool: 5.10, 5.11, 5.12, 5.13
ENS-Royal Decree 311/2022Article 20
Annex II: [op.acc.1] Identification, [op.acc.3] Segregation of functions and tasks
FR4.5-IE/EE
11.A.1-IE/EE
11.A.2-IE/EE
11.A.3-IE/EE
11.A.4-EE
11.A.5-EE
11.A.6-EE
11.A.7-EE
11.B.3-EE
11.B.4-EE
19.2-EE
19.3-EE
19.4-EE
19.6-EE

1. Resumen

11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …

Requirement

The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.

Guidance

  • Allocate privileged access rights to users as needed and, on an event-by-event basis in line with the access control policy referred to in point 11.1 of the Annex to the regulation (that is, only to individuals with the necessary authority to carry out activities that require privileged access and based on the minimum requirement for their functional roles).
  • Identify users who need privileged access (91) to a network and information system (e.g. operating systems, database management systems and applications). This should include any privileged physical access to, e.g. cryptographic codes, keys or devices and in line with point 13.3 of the Annex to the regulation.
  • Where appropriate, maintain an authorization process and a record of all allocated privileged access rights, consistent with the process for granting and revoking access rights (Annex to the regulation, point 11.2.2).

Examples of evidence

  • Clear policy on privileged account usage and access rules for privileged accounts.
  • List of users with privileged access and what systems they can access.
  • Documented approval records for granting privileged access.
  • Logs or records of access reviews and revocations.
  • Role-based access matrix showing who needs what access.
11.3.2 The policies referred to in point 11.3.1. shall: (a) establish strong identification …

Requirement

The policies referred to in point 11.3.1. shall: (a) establish strong identification, authentication such as multi-factor authentication and authorisation procedures for privileged accounts and system administration accounts; (b) set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance; (c) individualise and restrict system administration privileges to the highest extent possible, (d) provide that system administration accounts are only used to connect to system administration systems.

Guidance

  • Introduce higher authentication requirements for privileged access rights, such as re-authentication or authentication step-up before using privileged access rights.
  • Define and implement expiry requirements for privileged access rights, where appropriate.
  • In the absence of a system that allows all uses to be attributed to an individual with certainty, establish specific rules to avoid the use of generic administration user IDs (e.g. ‘root’) and manage and protect the authentication information of such identities.
  • Grant temporary privileged access only for the time necessary to implement approved changes or activities (e.g. for maintenance activities), rather than permanently granting privileged access rights.
    • Consider the frequency of system administration operations : daily tasks (e.g. backups and email routing) versus weekly or monthly tasks (e.g. reviewing memory and disk space).
  • Log all privileged access for audit purposes;
  • Assign separate identities with privileged access rights to individual users, rather than sharing or linking identities. Group identities for easier management if needed.
  • Use identities with privileged access rights exclusively for administrative tasks, not for day-to-day general tasks such as checking email or accessing the web. Where feasible (92) , separate privileged identities should be assigned for administrative tasks.
  • Ensure users are aware of their privileged access rights or when they are in privileged access mode, for example using specific user identities, user interface settings or equipment.

Examples of evidence

  • Measures for privileged access control and monitoring for privileged accounts, including granting and revoking privileged access rights.
  • Access assignment records showing how access rights are initially granted, based on job roles and responsibilities.
  • Clear definitions of user roles and the corresponding access rights associated with each role.
  • Audit trail and monitoring logs that capture the use of access rights, including any unauthorized access attempts and actions taken in response.
11.3.3 The relevant entities shall review access rights of privileged accounts and system administration …

Requirement

The relevant entities shall review access rights of privileged accounts and system administration accounts at planned intervals and be modified based on organisational changes and shall document the results of the review, including the necessary changes of access rights.

Guidance

  • Verify whether the duties, roles, responsibilities and competences of system administrators still qualify them for working with privileged access rights.

Examples of evidence

  • Records of reviews and updates showing that access rights are reviewed regularly and updated as necessary.
  • Periodic access reviews meaning evidence of regular reviews of user access rights to ensure they remain appropriate over time.
  • Change management logs of changes to access rights, reflecting any alterations due to role changes or termination of employment.
  • Compliance audits with reports from internal or external audits verifying that the management of access rights aligns with the policy and regulatory requirements.

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

Requisitos

3. Regulaciones relacionadas

Regulaciones

Incidencias vinculadas

Vínculos
is related to 11.3. Privileged accounts and system administration accounts