Requirement
In addition to the subcontrols in ECC control 2-2-3, cybersecurity requirements for identity and access management must cover at least the following:
Sub-Controls
2-1-1-1
Requirement: Strict restriction to allow only the minimum number of personnel accessing, viewing and sharing data based on lists of privileges limited to Saudi-national employees unless exempted by the Authorizing Official (the head of the organization or his/her delegate) and those lists are approved by the Authorizing Official.
2-1-1-2
Requirement: Prohibiting the sharing of approved lists of privileges with unauthorized persons.
References
- ECC – 2:2024 equivalent: 2-2-3
