Requirement
In addition to the subcontrols in ECC control 2-2-3, cybersecurity requirements for identity and access management of critical systems must include at least the following:
Sub-Controls
2-2-1-1
Requirement: Prohibiting remote access from outside the Kingdom of Saudi Arabia.
2-2-1-2
Requirement: Restricting remote access from inside the Kingdom of Saudi Arabia and verifying each access attempt by the organization's security operations center, and continuously monitoring activities related to remote access.
2-2-1-3
Requirement: Using multi-factor authentication for all users.
2-2-1-4
Requirement: Using multi-factor authentication for privileged users, and on systems utilized for managing critical systems stated in control 2-3-1-4.
2-2-1-5
Requirement: Developing and implementing a high-standard and secure password policy.
2-2-1-6
Requirement: Utilizing secure methods and algorithms for storing and processing passwords, such as: Hashing functions.
2-2-1-7
Requirement: Securely managing service accounts for applications and systems, and disabling interactive login from these accounts.
2-2-1-8
Requirement: Prohibiting direct access and interaction with databases for all users except for database administrators. Users' access and interaction with databases must be through applications only, with consideration given to applying security solutions that limit or prohibit visibility of classified data to database administrators.
References
- ECC – 2:2024 equivalent: 2-2-3
