|
+PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of … |
PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of …StatementAccess permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties GuidanceReview logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed GuidanceTake attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health) GuidanceRestrict access and privileges to the minimum necessary (e.g., zero trust architecture) GuidancePeriodically review the privileges associated with critical business functions to confirm proper separation of duties 1. Yleiskatsaus
1.1 Viittaukset1.2 Tunnistetut vaatimukset1.3 Liittyvät säädökset2. Tunnistetut vaatimukset
3. Liittyvät säädökset
Linkitetyt tehtävät |