IAM-25—Logical Access Role Permission Authorization

>Control Description

Initial permission definitions, and changes to permissions, associated with logical access roles are approved by authorized personnel.

Theme

Process

Type

Preventive

Policy/Standard

Access Management Procedure

>Implementation Guidance

1. Ensure that access to systems is granted after appropriate approvals. 2. Ensure that production access is controlled via authentication methods.

>Testing Procedure

1. Observe and validate for a sample user, that the access to the systems was approved by the appropriate party based on the business need. 2. Validate for a sample of services, that production access is controlled via appropriate authentication methods and is configured to use appropriate logical access lists.