03.04.05 Access Restrictions for Change

Statement

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Guidance

Changes to the hardware, software, or firmware components of the system or the operational procedures related to the system can have potentially significant effects on the security of the system. Therefore, organizations permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).

Assessment objective

physical access restrictions associated with changes to the system are defined and documented.

Assessment objective

physical access restrictions associated with changes to the system are approved.

Assessment objective

physical access restrictions associated with changes to the system are enforced.

Assessment objective

logical access restrictions associated with changes to the system are defined and documented.

Assessment objective

logical access restrictions associated with changes to the system are approved.

Assessment objective

logical access restrictions associated with changes to the system are enforced.

Assessment method

• configuration management policy and procedures procedures for access restrictions for system changes configuration management plan system design documentation system architecture system configuration settings logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with logical access control responsibilities personnel with physical access control responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing access restrictions for system changes mechanisms for supporting, implementing, or enforcing access restrictions associated with system changes

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final