11.5.2 For that purpose, the relevant entities shall: (a) set up unique identities for network and …

Requirement

For that purpose, the relevant entities shall: (a) set up unique identities for network and information systems and their users; (b) link the identity of users to a single person; (c) ensure oversight of identities of network and information systems; (d) apply logging to the management of identities.

Guidance

• Consider that providing or revoking access to assets is usually a multi-step procedure:
  • confirming the business requirements for an identity to be established;
  • verifying the identity of an entity before allocating them a logical identity;
  • establishing an identity;
  • configuring and activating the identity, which also includes configuration and initial setup of related authentication services; and
  • providing or revoking the identity’s specific access rights, based on appropriate authorization or entitlement decisions (section 11.2).
• Make sure that identities assigned to network and information systems (non-human users) are subject to appropriately segregated approval and independent ongoing oversight.
• Apply logging to the management of identities in cooperation with human resource security (section 10.1) where possible.

Examples of evidence

• Identity records, for example user profiles with unique identifiers (e.g. usernames and employee IDs) and evidence of linking these identities to specific individuals (e.g. HR records).
• Logs of reviews or approvals for identities for network and information systems and their users.
• Logs or reports related to identity management.
• Evidence of the systems in place that enforce access control, such as IAM solutions.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -