IAM-01—Logical Access Provisioning

>Control Description

Logical access provisioning to information systems requires approval from appropriate personnel.

Theme

Process

Type

Preventive

Policy/Standard

Access Management Procedure

>Implementation Guidance

1. Design and document a process for Logical Access and requirements for access provisioning. 2. Ensure access approval logic is mandated in the access management portal accordingly. 3. Ensure that the access management portal is updated with the relevant approvers.

>Testing Procedure

1. Inspect Organization Logical Access Policy and/or Standard to determine that the requirements for access provisioning were defined. 2. Inspect evidence of the workflow from access management portal showing access requires approval and is provisioned upon approval. 3. Inspect the system generated list of identity and access groups which are in-scope and associated workgroups with approvers from access management portal. 4. Inspect access provisioning system logs for a selection of users who were granted access to production systems.