Requirement
In addition to Subcontrols in the ECC control 2-2-3, the CSP shall cover the following additional Subcontrols for cybersecurity requirements for identity and access management requirements, as a minimum:
Sub-Controls
2-2-P-1-1
Requirement: Identity and access management of generic accounts credentials for accountability cannot be assigned for a specific individual.
2-2-P-1-2
Requirement: Secure session management, including session authenticity, session lockout, and session timeout termination.
2-2-P-1-3
Requirement: Multi-factor authentication for privileged users, and candidates of personnel with access to Cloud Technology Stack.
2-2-P-1-4
Requirement: Formal process to detect and prevent unauthorized access (e.g., unsuccessful login attempt threshold).
2-2-P-1-5
Requirement: Utilizing secure methods and algorithms for saving and processing passwords, such as: Secure Hashing functions.
2-2-P-1-6
Requirement: Secure management of third-party personnel's accounts.
2-2-P-1-7
Requirement: Access control enforced to management systems, administrative consoles.
2-2-P-1-8
Requirement: Masking of displayed authentication inputs, especially passwords, to prevent shoulder surfing.
2-2-P-1-9
Requirement: Getting CST's approval before accessing any CST-related asset by the CSP or CSP's third parties.
2-2-P-1-10
Requirement: Capability to immediately interrupt a remote access session and prevent any future access for a user.
2-2-P-1-11
Requirement: Provision to CSTs of multi-factor authentication services for privileged cloud users.
2-2-P-1-12
Requirement: Assurance of restricted and controlled access to storage systems and means (such as Storage Area Network (SAN)).
References
- ECC – 2:2024 equivalent: 2-2-3
