11.5 Identification

Requirement

The relevant entities shall manage the full life cycle of identities of network and information systems and their users.

Guidance

• Establish and maintain an inventory of all identities managed in the entity.
  • The inventory should include both user and privileged or system administrator identities. The inventory should contain, as a minimum, the person’s name, username, start/stop dates and the level of privileges for each identity .
  • The inventory should also include all service identities and have these identity records as a minimum including department owner, review date, purpose and the level of privileges for each service identity.

Examples of evidence

• Documented policy or procedure related to identity management, if available.
• Reports from internal or external audits verifying that the management of identities aligns with the policy and regulatory requirements.

Requirement

For that purpose, the relevant entities shall: (a) set up unique identities for network and information systems and their users; (b) link the identity of users to a single person; (c) ensure oversight of identities of network and information systems; (d) apply logging to the management of identities.

Guidance

• Consider that providing or revoking access to assets is usually a multi-step procedure:
  • confirming the business requirements for an identity to be established;
  • verifying the identity of an entity before allocating them a logical identity;
  • establishing an identity;
  • configuring and activating the identity, which also includes configuration and initial setup of related authentication services; and
  • providing or revoking the identity’s specific access rights, based on appropriate authorization or entitlement decisions (section 11.2).
• Make sure that identities assigned to network and information systems (non-human users) are subject to appropriately segregated approval and independent ongoing oversight.
• Apply logging to the management of identities in cooperation with human resource security (section 10.1) where possible.

Examples of evidence

• Identity records, for example user profiles with unique identifiers (e.g. usernames and employee IDs) and evidence of linking these identities to specific individuals (e.g. HR records).
• Logs of reviews or approvals for identities for network and information systems and their users.
• Logs or reports related to identity management.
• Evidence of the systems in place that enforce access control, such as IAM solutions.

Requirement

The relevant entities shall only permit identities assigned to multiple persons, such as shared identities, where they are necessary for business or operational reasons and are subject to an explicit approval process and documentation. The relevant entities shall take identities assigned to multiple persons into account in the cybersecurity risk management framework referred to in point 2.1.

Guidance

• Shared identities should be avoided unless strictly necessary for business or operational reasons (94). In such cases, their use must be formally justified, explicitly approved and properly documented. Examples of technical, procedural and governance controls to enhance their protection include (indicative, non-exhaustive list):
  • MFA enforcement;
  • Least privilege concept enforcement;
  • Time-bound or just-in-time access;
  • Checking out the shared credentials through a tool which logs who accessed the identity and when. If check-out is not possible, consider using privileged session recording or proxy-based access auditing;
  • Session attribution techniques to link shared identity use back to individual users;
  • Logging;
  • Credential vaulting with auto-rotation;
  • Prohibition of storing shared credentials in personal files, emails or messaging platforms;
  • Network segmentation so that shared account use is limited to isolated network segments or virtual environments; and
  • Mandatory training on acceptable use and accountability.
• These identities should be clearly recorded in the cybersecurity risk management framework, with appropriate controls in place to mitigate associated risks, including enhanced monitoring and accountability measures.

Examples of evidence

• Approval records for exceptions.

Requirement

The relevant entities shall regularly review the identities for network and information systems and their users and, if no longer needed, deactivate them without delay.

Guidance

• Verify that all active identities are reviewed. This can be done on a recurring schedule, as a minimum quarterly, or more frequently. However, for micro-sized entities, this can be done annually.
• Disable or remove, in a timely fashion, identities that they are no longer required, for example delete or disable any dormant identities after a predefined period of days of inactivity, where supported.

Examples of evidence

• Records of reviews and updates showing that identities are reviewed regularly and updated as necessary.
• Records of changes to identities, reflecting any alterations due to role changes or termination of employment or inactivity.

Tips: guidance

• Centralize identity management through a directory or identity service.
• Where appropriate, define different levels of identification required based on role, use or need.

Tips: examples of evidence

• Evidence of the systems in place, such as IAM solutions.