11.1.2 The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff …

Requirement

The policies referred to in point 11.1.1. shall: (a) address access by persons, including staff, visitors and external entities such as suppliers and service providers; (b) address access by network and information system processes; (c) ensure that access is only granted to users that have been adequately authenticated.

Guidance

• Implement access control rules by defining and mapping appropriate access rights and restrictions to human users or network and information system processes (e.g. a machine, device or a service). To simplify access control management, assign specific roles to groups.
  • Access control rules can be implemented in different granularities, ranging from covering whole networks or systems to specific data fields and can also consider properties, such as user location or the type of network connection that is used for access.
  • Use business requirements and risk assessment results to define which access control rules are applied and which granularity is required.
• Take into account the following when defining and implementing access control rules:
  • consistency between access rights and asset classification;
  • consistency between access rights and physical perimeter security needs and requirements;
  • consideration of all types of available connections in distributed environments so entities are only provided with access to associated assets, including networks and network services, that they are authorized to use;
  • consideration of how elements or factors relevant to dynamic access control can be reflected.
• Develop documented procedures and defined responsibilities to support the access control rules.

Examples of evidence

• Access control policy document outlining the access control requirements, procedures and responsibilities.
• User access records showing the list of users and their corresponding levels of access to various network and information systems.
• Authentication protocols, meaning documentation of the authentication methods in place, such as MFA.
• Authorization mechanisms with details on how permissions are granted, reviewed and revoked, ensuring that access rights are in line with users’ roles, responsibilities and authorities.
• Access logs that record user access activities, which can be used to track and audit user behaviour within the system in the event of suspected misconduct.
• Access rights review records showing alignment with asset classifications.
• Records of access control assessments that align access rights with physical security requirements.
• Network diagrams showing access control measures for different connection types and network access control policies.
• Logs showing dynamic access control decisions based on user behaviour or environment factors

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• ENISA -