Process for granting access rights at the start of employment relationships

Critical
High
Normal
Low

When a person starts an employment relationship, he or she is granted access to all data systems related to his or her role at once.

Connected other frameworks and requirements:
9.2.1: User registration and de-registration
ISO 27001
9.2.2: User access provisioning
ISO 27001
PR.AC-1: Identity and credential management
NIST CSF
5.16: Identity management
ISO 27001

Process for removing hardware and access rights at termination of employment relationship

Critical
High
Normal
Low

Our organization has defined procedures for coordinating, at the time of termination of employment, e.g..:

  • Hardware recovery
  • Removal of access rights
  • Restoration of other information assets
Connected other frameworks and requirements:
8.1.4: Return of assets
ISO 27001
9.2.1: User registration and de-registration
ISO 27001
9.2.6: Removal or adjustment of access rights
ISO 27001
PR.AC-1: Identity and credential management
NIST CSF
5.11: Return of assets
ISO 27001

Features and instructions for access management in offered cloud services

Critical
High
Normal
Low

When offering cloud services, the organisation should provide the technical implementation to enable the customer to manage the users access rights to their account.

The organisation should also provide instructions and specifications for the use of the user management (e.g. help articles, FAQs), e.g. related to available authentication methods, single sign-on capabilities and different admin actions.

Connected other frameworks and requirements:
PR.AC-1: Identity and credential management
NIST CSF
9.2.2: User access provisioning
ISO 27017

Features and instructions for user registration and de-registration in offered cloud services

Critical
High
Normal
Low

When offering cloud services, the organisation should provide the technical implementation to enable the customer to manage the user registration and deregistration to the service. 

The organisation should also provide instructions and specifications for the creation / deletion of users (e.g. help articles, FAQs), e.g. related to different user levels, user invitation process and different admin actions.

Connected other frameworks and requirements:
PR.AC-1: Identity and credential management
NIST CSF
PR.AC-6: Proof of identity
NIST CSF
9.2.1: User registration and de-registration
ISO 27017
9.2: User access management
ISO 27018
9.2.1: User registration and de-registration
ISO 27018

Instructions for reporting changes affecting access rights

Critical
High
Normal
Low

Supervisors have been instructed to notify the owners of data systems in advance of significant changes in the employment relationships of subordinates, such as promotions, discounts, termination of employment or other changes in the job role.

Based on the notification, a person's access rights can be updated either from the centralized management system or from individual data systems.

Connected other frameworks and requirements:
9.2.6: Removal or adjustment of access rights
ISO 27001
I06: Pääsyoikeuksien hallinnointi
PR.AC-1: Identity and credential management
NIST CSF
5.18: Access rights
ISO 27001

Defining and documenting access roles

Critical
High
Normal
Low

The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.

The following should be considered to support access management:

  • how much information each user needs access to
  • how widely the user should be able to edit data (read, write, delete, print, execute)
  • whether other applications have access to the data
  • whether the data can be segregated within the property so that sensitive data is less exposed
Connected other frameworks and requirements:
I06: Pääsyoikeuksien hallinnointi
25. Data protection by design and by default
GDPR
5. Principles relating to processing of personal data
GDPR
9.1.1: Access control policy
ISO 27001
9.2.2: User access provisioning
ISO 27001
No items found.