Defining and documenting access roles

Critical
High
Normal
Low

The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.

The following should be considered to support access management:

  • how much information each user needs access to
  • how widely the user should be able to edit data (read, write, delete, print, execute)
  • whether other applications have access to the data
  • whether the data can be segregated within the property so that sensitive data is less exposed
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
25. Data protection by design and by default
GDPR
5. Principles relating to processing of personal data
GDPR
9.1.1: Access control policy
ISO 27001
9.2.2: User access provisioning
ISO 27001

Access management for files stored in the cloud

Critical
High
Normal
Low

By monitoring the amount of information shared in cloud services, efforts can be made to identify risks that could lead to unauthorized disclosure of information. With respect to files one may e.g. monitor:

  • Which employees share the most files in the cloud services?
  • How often DLP policies have issued alerts?
  • How often the warnings issued by DLP policies are ignored?
  • How much important information is in other cloud services - beyond the reach of DLP control?
Connected other frameworks and requirements:
9.4.1: Information access restriction
ISO 27001
12.4.1: Event logging
ISO 27001
8.3: Information access restriction
ISO 27001
No items found.