Requirement
The cybersecurity requirements for identity and access management must be implemented.
Control Implementation Guidelines
- All cybersecurity requirements must be implemented for the organization's approved identity and access management procedures. It is also recommended that the identity and access management cover the following, but not limited to
- User Authentication based on user login management
- Password management based on the organization's password policy
- User authorization management based on a need-to-know and Need-to-use basis
- User authorization management based on least privilege and Segregation of Duties
- Remote access management to the organization's networks
- Access Cancellation and Update Management
Expected Deliverables
- Action plan for cybersecurity requirements for Identity and Access Management
- Evidence that the identity and access management controls must be implemented on all technical and information assets in the organization, including but not limited to, the configuration of all technical information systems in line with the cybersecurity controls and requirements of identity and access management
