Personnel guidelines for safe data system and authentication info usage

Critical
High
Normal
Low

The organization should have defined guidelines for the generally acceptable use of data systems and for the management of the necessary credentials.

In addition, the owners of data systems classified as 'High' or 'Critical' priority can define, document, and implement more specific guidelines for the use of that particular data system. These guidelines can describe e.g. security requirements related to the data contained in the system.

Connected other frameworks and requirements:
32. Security of processing
GDPR
29. Processing under the authority of the controller or processor
GDPR
8.1.3: Acceptable use of assets
ISO 27001
12.1.1: Documented operating procedures
ISO 27001
9.1.1: Access control policy
ISO 27001

Use and evaluation of password management system

Critical
High
Normal
Low

The password management system allows the user in a registration situation to decide how complex a password is to be set this time and to remember it on behalf of the user.

When using the password management system, e.g. the following principles:

  • the system will force the use of unique passwords in the future
  • the system warns the user to change old recurring passwords
  • the system forces you to choose passwords that are complex enough, of high quality
  • the system forces the user to change the temporary password the first time they log on
  • the system forces you to change the password that may have been compromised in the data leak
  • the system prevents the same passwords from being reused
  • the system keeps password files separate from other data and strongly encrypted
Connected other frameworks and requirements:
9.3: User responsibilities
ISO 27001
9.3.1: Use of secret authentication information
ISO 27001
9.4.3: Password management system
ISO 27001
5.17: Authentication information
ISO 27001

Enabling multi-factor authentication for all users

Critical
High
Normal
Low

Multi-factor authentication (MFA) helps protect devices and data. To apply it, users must have more information in the identity management system than just an email address - for example, a phone number or an attached authenticator application (e.g. Microsoft, Google, or LastPass Authenticator).

Connected other frameworks and requirements:
9.3: User responsibilities
ISO 27001
9.3.1: Use of secret authentication information
ISO 27001
PR.AC-7: User, devide and other asset authentication
NIST CSF
No items found.