11.4 Administration systems

Requirement

The relevant entities shall restrict and control the use of system administration systems in accordance with the access control policy referred to in point 11.1.

Guidance

• Access to system administration systems must be strictly controlled in line with the access control policy. Only authorized personnel should be granted such access and all activity must be logged and regularly reviewed.
• Measures should be in place to detect unauthorized access and ensure accountability through audit trails and periodic security assessments.
• Access logs from system administration systems should be integrated into the entity's centralized log management or SIEM solution. Automated alerts must be configured to detect and notify of any suspicious or unauthorized access attempts, ensuring a timely response and ongoing compliance with security policies.
• The retention period for logs must be clearly defined based on business needs, legal requirements and network and information security objectives.
• Logs should capture relevant events necessary for security monitoring, incident detection and forensic analysis, such as access attempts, administrative actions and system changes.

Examples of evidence

• Regularly maintained logs that track access to system administration systems (93).
• Audit reports from internal or external security audits that assess compliance with the policy.

Requirement

For that purpose, the relevant entities shall: (a) only use system administration systems for system administration purposes and not for any other operations; (b) separate logically such systems from application software not used for system administrative purposes, (c) protect access to system administration systems through authentication and encryption.

Guidance

• Implement strict access controls to ensure that administrative systems are used exclusively for their intended purpose. For instance, only allow authorised personnel with specific roles (e.g. system administrators and IT staff) access to system administration systems.
• Physically or logically isolate administrative systems from other application servers, for example use network segmentation to create separate zones for system administration systems and other systems, such as application servers. If applicable, physically inspect server racks to ensure separation.
• Require strong authentication mechanisms such as MFA for accessing system administration systems.
• Encrypt communication channels (e.g. secure shell protocol, hypertext transfer protocol secure) to protect data in transit to and from system administration systems.
• Encrypt sensitive configuration files and credentials stored on system administration systems.
• Ensure that application protocols are securely implemented. In addition, verify that any SSO or federation protocols are correctly implemented and conform to their specifications.

Examples of evidence

• Regularly maintained logs that track access to system administration systems.
• Network segmentation documentation indicating how system administration systems are logically or physically separated from other systems.
• Documented authentication methods used to secure access to administration systems.
• Information on encryption protocols applied to protect data transmitted to and from system administration systems.

Tips: guidance

• Consider using a centralized privileged access management (PAM) solution.
• Consider using a cloud access security broker (CASB) to enhance the visibility of, control over and the security of cloud service usage.
• Regularly audit system logs to monitor usage patterns and identify any unauthorised activities.
• Train personnel in the proper use of system administration systems.

Tips: examples of evidence

• Regularly maintained logs that track access to administration systems.
• Incident response records of any incidents related to system administration system misuse or unauthorized access.
• User training records meaning evidence that personnel have been trained in the proper use of system administration systems, for example training materials, attendance records or completion certificates.