The identification of actors in information processing environments requires the following additional measures:
- strong user authentication based on at least two factors is in place
- terminal devices are technically identified (device authentication, 802.1X, or an equivalent procedure) before being granted access to the network or service, unless physical security measures restrict network connectivity to a narrow scope (e. g. a server placed in a locked equipment cabinet within a security area).
In certain situations, electronic identification methods may be replaced by physical security measures (e. g. access to the system allowed only from a strictly limited and physically protected area, such as a locked equipment cabinet monitored with strong authentication). When relying on physical security measures, the requirements for traceability must also be met, particularly regarding the retention periods for log data and similar records. In such cases, actual system login may consist of, for example, a user ID and password pair.
