Free ebook: NIS2 ready using ISO 27001 best practices
Download ebook

Regular reviewing of data system access rights

Critical
High
Normal
Low

Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.

When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.

Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
4 luku, 16 §: Tietojärjestelmien käyttöoikeuksien hallinta
24. Responsibility of the controller
GDPR
32. Security of processing
GDPR
5. Principles relating to processing of personal data
GDPR

Instructions for reporting changes affecting access rights

Critical
High
Normal
Low

Supervisors have been instructed to notify the owners of data systems in advance of significant changes in the employment relationships of subordinates, such as promotions, discounts, termination of employment or other changes in the job role.

Based on the notification, a person's access rights can be updated either from the centralized management system or from individual data systems.

Connected other frameworks and requirements:
9.2.6: Removal or adjustment of access rights
ISO 27001
I06: Pääsyoikeuksien hallinnointi
PR.AC-1: Identity and credential management
NIST CSF
5.18: Access rights
ISO 27001

Review of access right for changed employee roles

Critical
High
Normal
Low

In all changes on employment relationship, access rights should be reviewed in cooperation with the owners of the protected property and re-granted to the person completely when there is a significant change in the person's employment. A change can be a promotion or a change of role (e.g., moving from one unit to another).

Connected other frameworks and requirements:
9.2.5: Review of user access rights
ISO 27001
5.18: Access rights
ISO 27001
4.2 (MIL1): Control Logical Access
C2M2

Restriction of access rights at high risk times of employment

Critical
High
Normal
Low

If a person's employment is terminating or significantly changing, the reduction of access rights to assets should be considered, depending on the following:

  • a person’s reluctance towards the upcoming change
  • the extent of the person’s current access rights and responsibilities
  • the value of the assets to which the employee has access
Connected other frameworks and requirements:
9.2.6: Removal or adjustment of access rights
ISO 27001
5.18: Access rights
ISO 27001

Identification and management of shadow IT

Critical
High
Normal
Low

On average, the IT administrator estimates that staff use about 50 cloud services when the actual number is 1,000. Many of these are important for staff productivity and are used outside the organization’s network, so firewall rules do not solve the challenge.

Systems that focus on identifying and managing cloud services allow you to identify the cloud services used by your staff and monitor users of different services. This helps e.g.:

  • determine our own level of risk with respect to data in cloud services
  • review used services in regard to security
  • be able to report as required, e.g. on the location of data and data processors
Connected other frameworks and requirements:
9.2.2: User access provisioning
ISO 27001
5.18: Access rights
ISO 27001

Arranging training and guidance during orientation (or before granting access rights)

Critical
High
Normal
Low

Before granting access rights to data systems with confidential information employees have:

  • received appropriate guidance on their security responsibilities (including reporting responsibilities and responsibility for their own devices)
  • received appropriate guidance on their security roles related to their own role (including digital security rules related to their role and information systems and their acceptable use)
  • received information from cyber security contacts who can be asked for more information
Connected other frameworks and requirements:
2 luku, 4 §: Tiedonhallinnan järjestäminen tiedonhallintayksikössä
7.3: Termination and change of employment
ISO 27001
7.3.1: Termination or change of employment responsibilities
ISO 27001
9.2.2: User access provisioning
ISO 27001
PR.IP-11: Cybersecurity in human resources
NIST CSF
No items found.