Essential Cybersecurity Controls (ECC – 2 : 2024) 2-2-1

Requirement

Cybersecurity requirements for identity and access management must be defined, documented and approved.

Control Implementation Guidelines

• Develop and document cybersecurity policy for identity and access management in the organization, which may include, but is not limited to
  • Grant access, including
    • Access to user accounts
    • Privileged Access to accounts
    • Remote access to the organization's networks and systems
    • Define and approve the authority of each type of users
  • Revoke and Change Access
  • Review Identity and Access
  • Manage passwords
• Support the organization's policy by the Executive Management. This must be done through the approval of the representative

Relevant Cybersecurity Tools

• Identity and Access Management Policy Template

Expected Deliverables

• Cybersecurity policy that covers Identity and Access Management (e.g., electronic copy or official hard copy)
• Formal approval by the head of the organization or his/her deputy on the policy (e.g., via the organization's official e-mail, paper or electronic signature)