Access rights, privileged accounts and authentication

Catalog reference

Document and apply a logical and physical access control policy for your network and information systems, covering people (staff, visitors and outside parties) and systems, and granting access only to authenticated users. Give, change, remove and document access rights by need-to-know, least privilege and separation of duties, adjust them when people change or leave jobs, limit third-party access in scope and duration, keep a register and log changes, and review the rights on a schedule. Set a policy for privileged and system administration accounts with strong identification, authentication such as multi-factor authentication, and authorisation, dedicated administration accounts, minimal and individual privileges, and review. Limit and control administration systems. Manage the whole identity life cycle with unique identities tied to one person, allow shared identities only with approval and documentation, review identities and deactivate those no longer needed, and log identity management. Apply secure authentication matched to the asset classification, handle secret authentication information confidentially, require changes and resets, lock after failed attempts, end idle sessions, and use multi-factor or continuous authentication where fitting. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement