Data Cybersecurity Controls (DCC – 1 : 2022) Identity and Access Management
Restricts logical access to information and technology assets so unauthorized access is prevented and users receive only the access necessary to accomplish their assigned tasks.
-
2-1-1
In addition to the subcontrols in ECC control 2-2-3, cybersecurity requirements for identity and access management must cover at least the following:
-
2-1-2
Managing identities and access rights to view data using Privileged Access Management systems.
-
2-1-3
In addition to ECC subcontrol 2-2-3-5, the approved lists of privileges and privileges used to handle data must be reviewed as specified for each data classification level. Required frequency by data classification level. Public: At least annually. Confidential: At least annually. Secret: At least every 3 months. Top Secret: At least every 3 months.
Need help putting this into practice? See our NCA DCC compliance services.
See LakeRidge in action.
Talk with our team about your framework, your gaps, and the right plan.
Get a demo