11.4.1 The relevant entities shall restrict and control the use of system administration systems in …

Requirement

The relevant entities shall restrict and control the use of system administration systems in accordance with the access control policy referred to in point 11.1.

Guidance

• Access to system administration systems must be strictly controlled in line with the access control policy. Only authorized personnel should be granted such access and all activity must be logged and regularly reviewed.
• Measures should be in place to detect unauthorized access and ensure accountability through audit trails and periodic security assessments.
• Access logs from system administration systems should be integrated into the entity's centralized log management or SIEM solution. Automated alerts must be configured to detect and notify of any suspicious or unauthorized access attempts, ensuring a timely response and ongoing compliance with security policies.
• The retention period for logs must be clearly defined based on business needs, legal requirements and network and information security objectives.
• Logs should capture relevant events necessary for security monitoring, incident detection and forensic analysis, such as access attempts, administrative actions and system changes.

Examples of evidence

• Regularly maintained logs that track access to system administration systems (93).
• Audit reports from internal or external security audits that assess compliance with the policy.

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

3. Povezani propisi

Povezani zadaci

• ENISA -