Identify the users of the information systems

The organization verifies the identity of users and associates them with user information. These should also be confirmed before any interaction.

Identity verification must be performed according to pre-written and approved rules.

The organisation must manage all of it’s users and their privileges. This includes all third party users, which have access into the organisations data or systems.

The organisation must remove users entirely or remove privileges from them when they are no longer needed e.g when employee role changes.

The organization implements role-based access control with predefined access roles for the various protected assets that entitle access to the associated asset. Strictness of the access roles should reflect the security risks associated with the asset.

The following should be considered to support access management:

• how much information each user needs access to
• how widely the user should be able to edit data (read, write, delete, print, execute)
• whether other applications have access to the data
• whether the data can be segregated within the property so that sensitive data is less exposed

When working remotely, the employee must follow the following guidelines:

• remote work may only be performed in rooms where eavesdropping is not possible
• remote work must be agreed in advance (e.g. on a one-off basis or in an employment contract with flexible work arrangements) or remote work must be requested by the employer
• the employee must ensure the required security for remote work equipment (e.g. backup, malware protection, firewall, encryption, updates)