11.3.1 The relevant entities shall maintain policies for management of privileged accounts and system …

Requirement

The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.

Guidance

• Allocate privileged access rights to users as needed and, on an event-by-event basis in line with the access control policy referred to in point 11.1 of the Annex to the regulation (that is, only to individuals with the necessary authority to carry out activities that require privileged access and based on the minimum requirement for their functional roles).
• Identify users who need privileged access (91) to a network and information system (e.g. operating systems, database management systems and applications). This should include any privileged physical access to, e.g. cryptographic codes, keys or devices and in line with point 13.3 of the Annex to the regulation.
• Where appropriate, maintain an authorization process and a record of all allocated privileged access rights, consistent with the process for granting and revoking access rights (Annex to the regulation, point 11.2.2).

Examples of evidence

• Clear policy on privileged account usage and access rules for privileged accounts.
• List of users with privileged access and what systems they can access.
• Documented approval records for granting privileged access.
• Logs or records of access reviews and revocations.
• Role-based access matrix showing who needs what access.

1. Resumen

1.1 Referencias

1.2 Requisitos identificados

1.3 Regulaciones relacionadas

2. Requisitos identificados

3. Regulaciones relacionadas

Incidencias vinculadas

• ENISA -