Management of identities and credentials

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

• System purpose and linked responsibilities
• System's data location (covered in a separate task)
• System's maintenance and development responsibilities and linked partners (covered in a separate task)
• When necessary system's access roles and authentication methods (covered in a separate task)
• When necessary systems interfaces to other systems (covered in a separate task)

Data system owner determines the access roles to the system in relation to the tasks of users. The compliance of the actual access rights with the planned ones must be monitored and the rights reassessed at regular intervals.

When reviewing access rights, care must also be taken to minimize admin rights and eliminate unnecessary accounts.

De-activated or expired user IDs should never be re-used for other users.

This is relevant as a general administration principle for self-developed cloud services and all other utilized data systems, where other maintenance may be provided by a partner organization, but access / user ID management by the organization itself.

The organization verifies the identity of users and associates them with user information. These should also be confirmed before any interaction.

Identity verification must be performed according to pre-written and approved rules.

The organization's information systems and hardware are comprehensively covered by systems management. Through system management, it is possible to e.g. automatic updates.

The organization has defined suitable means to identify outputs when it is necessary to ensure the conformity of products and services. This may involve assigning unique identifiers, such as serial numbers, batch codes, or physical labels, to products or batches.

The organization needs to also identify the status of outputs with respect to monitoring and measurement requirements throughout production and service provision.

When traceability is a requirement, the organization also needs to define controls for the unique identification of outputs, and shall retain the documented information necessary to enable traceability.