+Airteagal 20 2.

Airteagal 20 2.

Sna beartais agus nósanna imeachta um bainistiú céannachta dá dtagraítear i mír 1 beidh na nithe uile seo a leanas:

(a) 

gan dochar d’Airteagal 21 an chéad mhír, pointe (c), déanfar céannacht uathúil a chomhfhreagróidh do chuntas úsáideora uathúil a shannadh do gach ball foirne de chuid an eintitis airgeadais nó d’fhoireann na soláthraithe seirbhísí TFC tríú páirtí a gheobhaidh rochtain ar shócmhainní faisnéise agus sócmhainní TFC an eintitis airgeadais;

(b) 

próiseas bainistithe saolré céannachtaí agus cuntas lena ndéantar bainistíocht ar chruthú, athrú, athbhreithniú agus nuashonrú, díghníomhachtú sealadach, agus foirceannadh gach cuntais.

Chun críocha phointe (a), coimeádfaidh eintitis airgeadais taifid de na sannacháin chéannachta uile. Coimeádfar na taifid sin tar éis atheagrú ar an eintiteas airgeadais nó tar éis dheireadh an ghaoil chonarthaigh gan dochar do na ceanglais choinneála a leagtar síos i ndlí infheidhme an Aontais agus sa dlí náisiúnta.

Chun críocha phointe (b), cuirfidh eintitis airgeadais, i gcás inarb indéanta agus iomchuí, réitigh uathoibrithe in úsáid le haghaidh an phróisis bainistithe saolré céannachtaí.

1. Forbhreathnú

,

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
NOREA Authentication Methods
Use authentication methods commensurate with the classification and risk profile of ICT assets. Implement strong authentication methods, particularly for remote access, privileged access, and access to critical ICT assets.
NOREA Identity Management

Assign a unique identity to each staff member or staff of the third-party service provider accessing information and ICT assets. Implement a lifecycle management process for identities, covering creation, change, recertification, temporary deactivation, and termination of user accounts. Utilize automated solutions where applicable.
NOREA Privilige Access Management

Define access rights based on need-to-know, need-to-use, and least privilege principles, including provisions for remote and emergency access. Enforce segregation of duties to prevent unjustified access or combinations that could circumvent controls. Ensure user accountability by limiting generic and shared user accounts, enabling user identification for all ICT system actions. Implement controls and tools to restrict unauthorized access.
NOREA Account Management

Establish procedures for granting, changing, and revoking access rights, specifying roles and responsibilities. Define retention periods for access logs. Assign privileged, emergency, and administrator access on a need-to-use or ad-hoc basis, with automated solutions for privilege access management. Withdraw access rights promptly upon termination of employment or when no longer required. Conduct periodic reviews of access rights, ensuring at least annual reviews for non-critical ICT systems and semi-annual reviews for critical systems.