11.2.3 The relevant entities shall review access rights at planned intervals and shall modify them based …

Requirement

The relevant entities shall review access rights at planned intervals and shall modify them based on organisational changes. The relevant entities shall document the results of the review including the necessary changes of access rights.

Guidance

• Regularly review physical and logical access rights, taking into account:
  • users’ access rights after termination or change of employment;
  • authorisations for privileged access rights.
• Review and update the inventory of the authentication and authorization systems regularly.
• Perform access control reviews of assets to verify that all privileges are authorised on a recurring schedule at least annually.

Examples of evidence

• A central record (register or database) detailing all granted access rights, including user names, roles, access levels and dates of access changes.
• Approved access request forms supporting entries in the access rights register.
• Periodic access reviews meaning evidence of regular reviews of user access rights to ensure they remain appropriate over time.
• System logs showing all access rights management activities (creation, modification and deletion).
• Audit trail logs demonstrating access rights management, including timestamps, user IDs and actions performed.
• Records of incidents related to access rights management, including unauthorized access attempts and corrective actions.
• Reports from internal or external compliance audits verifying alignment with the access control policy.
• Physical inspection results of access control systems and their use, if applicable.
• Records of reviews and updates showing that access rights are reviewed regularly and updated as necessary.

Tips: guidance

• Centralize access control for all assets through a directory service or single sign on (SSO) provider, where supported.
• Implement a segregation of duties matrix and ensure that it is updated dynamically by automating how changes are handled in response to role assignments or task changes (e.g. integration with access control, IAM or enterprise resource planning (ERP) systems).

Tips: examples of evidence

• Evidence of a centralized directory service or SSO provider to manage access control, supported by documentation, logs, audit reports and records.
• Segregation of duties matrix.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -