.png)
The financial entities referred to in Article 16(1) of Regulation (EU) 2022/2554 shall develop, document, and implement procedures for the control of logical and physical access and shall enforce, monitor, and periodically review those procedures. Those procedures shall contain the following elements of control of logical and physical access:
(a) access rights to information assets, ICT assets, and their supported functions, and to critical locations of operation of the financial entity, are managed on a need-to-know, need-to-use and least privileges basis, including for remote and emergency access;
(b) user accountability, which ensures that users can be identified for the actions performed in the ICT systems;
(c) account management procedures to grant, change, or revoke access rights for user and generic accounts, including generic administrator accounts;
(d) authentication methods that are commensurate to the classification referred to in Article 30(1) and to the overall risk profile of ICT assets, and which are based on leading practices;
(e) access rights are periodically reviewed and are withdrawn when no longer required.
For the purposes of point (c), the financial entity shall assign privileged, emergency, and administrator access on a need-to-use or an ad-hoc basis for all ICT systems, and shall be logged in accordance with Article 34, first paragraph, point (f).
For the purposes of point (d), financial entities shall use strong authentication methods that are based on leading practices for remote access to the financial entities’ network, for privileged access, and for access to ICT assets supporting critical or important functions that are publicly available.
Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.
When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.
Secure areas of the organization cannot be accessed unnoticed. The premises are protected by appropriate access control. Only authorized persons have access to the secure areas.
To ensure authorized access and prevent unauthorized access to data and other related resources, the organization has defined and implemented clear rules for physical and logical access control.
Rules are implemented and enforced through several different tasks, but are also combined into an access control policy for clear communication and review.
All accounts, access rights and privileges should be traceable to the role responsible for them and the person who approved them.
The organization must develop, document, and implement procedures for logical and physical access control. These must take into account:
The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.
The following should be considered to support access management:
The organization shall ensure that the monitoring and management of remote connections is automated, that remote connections are encrypted to ensure their integrity and reliability, and that remote connections pass only through approved and managed Network Access Control (NAC).
The organization must also make possible for the remote connections to be closed within a specified time.
The organization verifies the identity of users and associates them with user information. These should also be confirmed before any interaction.
Identity verification must be performed according to pre-written and approved rules.
To ensure that authorized users have access to data systems and to prevent unauthorized access, the organization has defined formal processes for:
The implementation of these things must always take place through a defined, formal process.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
