|
+PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of … |
PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of …StatementAccess permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties GuidanceReview logical and physical access privileges periodically and whenever someone changes roles or leaves the organization, and promptly rescind privileges that are no longer needed GuidanceTake attributes of the requester and the requested resource into account for authorization decisions (e.g., geolocation, day/time, requester endpoint's cyber health) GuidanceRestrict access and privileges to the minimum necessary (e.g., zero trust architecture) GuidancePeriodically review the privileges associated with critical business functions to confirm proper separation of duties 1. Panoramica
1.1 Riferimenti1.2 Requisiti identificati1.3 Regolamentazioni correlate2. Requisiti identificati
3. Regolamentazioni correlate
Ticket collegati |