11.2.2. The relevant entities shall: (a) assign and revoke access rights based on the principles of …

(a)

assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;

(b)

ensure that access rights are modified accordingly upon termination or change of employment;

(c)

ensure that access to network and information systems is authorised by the relevant persons;

(d)

ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;

(e)

maintain a register of access rights granted;

(f)

apply logging to the management of access rights.