Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• TPM-24.4_A01 the time period within which third-party physical and logical access is revoked upon cessation of services or when access is no longer required is defined.
  Defined parameters: within 24 hours of cessation of services or of the determination that access is no longer required, and immediately for adverse or unplanned terminations
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.4_A02 third-party logical access (e.g., accounts, credentials, API keys, certificates, VPN and remote access) to organizational Technology Assets, Applications, Services and Data (TAASD) is revoked within the defined time period upon cessation of third-party services.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.4_A03 third-party physical access (e.g., badges, keys and visitor authorizations) to organizational facilities and Technology Assets, Applications, Services and Data (TAASD) is revoked within the defined time period upon cessation of third-party services.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.4_A04 third-party access that is no longer required during an ongoing relationship (e.g., completion of a project or change in personnel) is identified and revoked within the defined time period.
  Assessment rigor: 1
  Origin: SCF Created
• TPM-24.4_A05 a record of third-party access revocations, including the date of cessation or determination and the date of revocation, is retained.
  Assessment rigor: 2
  Origin: SCF Created

Kapcsolt feladatok

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.