Requirement
In addition to ECC subcontrol 2-2-3-5, the approved lists of privileges and privileges used to handle data must be reviewed as specified for each data classification level. Required frequency by data classification level. Public: At least annually. Confidential: At least annually. Secret: At least every 3 months. Top Secret: At least every 3 months.
References
- ECC – 2:2024 equivalent: 2-2-3-5
