Access policy

Catalog reference

Have an adopted policy on logical and physical access to your network and information systems, put it in writing and apply it demonstrably (art. 15(1)). The policy covers at least issuing, monitoring, using, changing and withdrawing identities and authorisations, and managing them (art. 15(2)). Check identities, means of authentication and authorisations periodically for necessity, correctness and currency, and change them where needed (art. 15(3)). The Cyberbeveiligingsregeling IenW (BWBR0052878, art. 13) adds for essential and important entities in its sectors that the policy covers privileged accounts and system administrator accounts: strong identification, authentication and authorisation procedures for them, system administration privileges that are as far as possible individual and limited, and privileges used only for system administration. Exclude this only if the Account is exclusively one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers. An entity that is only partly one of those types keeps both sets.