Requirement

11.3: Privileged accounts and system administration accounts

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.

2. The policies referred to in point 11.3.1 shall:

establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;
set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;
individualise and restrict system administration privileges to the highest extent possible,
provide that system administration accounts are only used to connect to system administration systems.

3. The relevant entities shall review access rights of privileged accounts and system administration accounts at planned intervals and be modified based on organisational changes, and shall document the results of the review, including the necessary changes of access rights.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

NIS2 Implementing Regulation

Other requirements of the framework

11.3: Privileged accounts and system administration accounts

Best practices

How to implement:

11.3: Privileged accounts and system administration accounts

This policy on

11.3: Privileged accounts and system administration accounts

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.

2. The policies referred to in point 11.3.1 shall:

establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;
set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;
individualise and restrict system administration privileges to the highest extent possible,
provide that system administration accounts are only used to connect to system administration systems.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

11.3: Privileged accounts and system administration accounts

Task name

Priority

Task completes