11.5.4 The relevant entities shall regularly review the identities for network and information systems and …

Requirement

The relevant entities shall regularly review the identities for network and information systems and their users and, if no longer needed, deactivate them without delay.

Guidance

• Verify that all active identities are reviewed. This can be done on a recurring schedule, as a minimum quarterly, or more frequently. However, for micro-sized entities, this can be done annually.
• Disable or remove, in a timely fashion, identities that they are no longer required, for example delete or disable any dormant identities after a predefined period of days of inactivity, where supported.

Examples of evidence

• Records of reviews and updates showing that identities are reviewed regularly and updated as necessary.
• Records of changes to identities, reflecting any alterations due to role changes or termination of employment or inactivity.

Tips: guidance

• Centralize identity management through a directory or identity service.
• Where appropriate, define different levels of identification required based on role, use or need.

Tips: examples of evidence

• Evidence of the systems in place, such as IAM solutions.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -