NIS2 Implementing Regulation

Requirement

11.2: Management of access rights

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.

2. The relevant entities shall:

assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;
ensure that access rights are modified accordingly upon termination or change of employment;
ensure that access to network and information systems is authorised by the relevant persons;
ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;
maintain a register of access rights granted;
apply logging to the management of access rights.

3. The relevant entities shall review access rights at planned intervals and shall modify them based on organisational changes. The relevant entities shall document the results of the review including the necessary changes of access rights.

See how Cyberday guides you to fulfill this requirement:

Start free trial

This requirement is part of the framework:

NIS2 Implementing Regulation

Free compliance assessment:

Other requirements of the framework

11.2: Management of access rights

Best practices

How to implement:

11.2: Management of access rights

This policy on

11.2: Management of access rights

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.

2. The relevant entities shall:

assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;
ensure that access rights are modified accordingly upon termination or change of employment;
ensure that access to network and information systems is authorised by the relevant persons;
ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;
maintain a register of access rights granted;
apply logging to the management of access rights.

3. The relevant entities shall review access rights at planned intervals and shall modify them based on organisational changes. The relevant entities shall document the results of the review including the necessary changes of access rights.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

11.2: Management of access rights

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

No other tasks found.

Complete these tasks in Cyberday ISMS ->

How to comply with this requirement

In Cyberday, requirements and controls are mapped to universal tasks. Each requirement is fulfilled with one or multiple tasks.

Here's a list of tasks that help you comply with the requirement

11.2: Management of access rights

of the framework

NIS2 Implementing Regulation

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

Regular reviewing of data system access rights

Critical

High

Normal

Low

System management

Access control and authentication

Regular reviewing of data system access rights

I06: Pääsyoikeuksien hallinnointi Katakri

16 §: Tietojärjestelmien käyttöoikeuksien hallinta TiHL

24. Responsibility of the controller GDPR

32. Security of processing GDPR

5. Principles relating to processing of personal data GDPR

Creating and maintaining an access control policy

Critical

High

Normal

Low

System management

Access control and authentication

Creating and maintaining an access control policy

40: Käyttövaltuuspolitiikka ja prosessi Digiturvan kokonaiskuvapalvelu

2.6.1: Create guidelines for access control NSM ICT-SP

2.6.2: Establish a formal process for administration of accounts, access rights and privileges NSM ICT-SP

6.8: Define and Maintain Role-Based Access Control CIS 18

14.5.12): Kibernetinio saugumo prieigos ir duomenų teisių politika NIS2 Lithuania

Descriptions of different access rights management processes

Critical

High

Normal

Low

System management

Access control and authentication

Descriptions of different access rights management processes

ACCESS-1: Establish Identities and Manage Authentication C2M2

I-06: THE PRINCIPLE OF LEAST PRIVILEGE – MANAGEMENT OF ACCESS RIGHTS Katakri 2020

4.5: Käyttöoikeuksien hallinta TiHL tietoturvavaatimukset

4.2.1: Access Management TISAX

PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users, and processes.CyberFundamentals

Segregation of information security related duties

Critical

High

Normal

Low

Risk management and leadership

Cyber security management

Segregation of information security related duties

6.1.2: Segregation of duties ISO 27001

ID.RA-3: Threat identification NIST

PR.AC-4: Access permissions and authorizations NIST

PR.DS-5: Data leak protection NIST

HAL-02.1: Tehtävät ja vastuut - tehtävien eriyttäminen Julkri

Access rights are managed by the principle of the least privilege

Critical

High

Normal

Low

System management

Access control and authentication

Access rights are managed by the principle of the least privilege

PR.AC-4: Access permissions and authorizations NIST

I-06: THE PRINCIPLE OF LEAST PRIVILEGE – MANAGEMENT OF ACCESS RIGHTS Katakri 2020

PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.CyberFundamentals

2.6.1: Create guidelines for access control NSM ICT-SP

2.6.4: Minimise privileges for end users and special users NSM ICT-SP

Implementing formal access control processes

Critical

High

Normal

Low

System management

Access control and authentication

Implementing formal access control processes

Članak 30.1.i (Pristup): Politike kontrole pristupa NIS2 Croatia

9.7 §: Pääsynhallinta, todentaminen ja MFA Kyberturvallisuuslaki

4.1.2: Security of authentication TISAX

30 § 3.9° (l'accès): Contrôle d'accès NIS2 Belgium

2.6.2: Establish a formal process for administration of accounts, access rights and privileges NSM ICT-SP

Complete these tasks in Cyberday ISMS ->

The ISMS component hierachy

When building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.

Framework

Sets the overall compliance standard or regulation your organization needs to follow.

Requirements

Break down the framework into specific obligations that must be met.

Tasks

Concrete actions and activities your team carries out to satisfy each requirement.

Policies

Documented rules and practices that are created and maintained as a result of completing tasks.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍

Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.

Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.

Do it once - we automatically apply it to all current and future frameworks.

Start free trial