Requirement
[A: M | B: M] Cybersecurity requirements for identity and access management must be defined, documented and approved, covering at minimum:
Sub-Controls
2-2-1-1
Requirement: [A: M | B: M] User authentication based on secure management of username and password.
2-2-1-2
Requirement: [A: M | B: M] Multi-Factor Authentication (MFA) for remote access, including email and external applications.
2-2-1-3
Requirement: [A: M | B: M] Management of user authorization based on access-control principles: need-to-know and need-to-use, least privilege, and segregation of duties.
2-2-1-4
Requirement: [A: M | B: R] Privileged Access Management.
2-2-1-5
Requirement: [A: M | B: M] Periodic review of identities and access rights.
