Requirement
In addition to Subcontrols in the ECC control 2-2-3, the CST shall cover the following additional Subcontrols for cybersecurity requirements for identity and access management requirements, as a minimum:
Sub-Controls
2-2-T-1-1
Requirement: Identity and access management for all cloud credentials along their full lifecycle.
2-2-T-1-2
Requirement: Confidentiality of cloud user identification, cloud credential and cloud access rights information, including the requirement on users to keep them private (for employed, third party and CST personnel).
2-2-T-1-3
Requirement: Secure session management, including session authenticity, session lockout, and session timeout termination on the cloud.
2-2-T-1-4
Requirement: Multi-factor authentication for privileged cloud users.
2-2-T-1-5
Requirement: Formal process to detect and prevent unauthorized access to cloud (such as a threshold of unsuccessful login attempts).
References
- ECC – 2:2024 equivalent: 2-2-3
