Requirement
In addition to subcontrols in ECC control 2-2-3, cybersecurity requirements for identity and access management in OT/ICS environment must include, at a minimum, the following:
Sub-Controls
2-2-1-1
Requirement: Identity and access management lifecycle for OT/ICS is separated and independent from Information Technology (IT) including centrally managed identity and access management solutions.
2-2-1-2
Requirement: Service accounts must be managed securely for OT/ICS services, applications, systems, and devices that are separated and disconnected from interactive users account logins.
2-2-1-3
Requirement: Default credentials for all OT/ICS assets must be changed, disabled, or removed.
2-2-1-4
Requirement: Sessions must be managed securely, including session authenticity, session lockout, and session timeout termination.
2-2-1-5
Requirement: Automatic disabling/removing of service accounts, programs, or accounts related to (OT/ICS) assets must be prevented, except for monitoring systems.
2-2-1-6
Requirement: Dual approval and explicit privilege escalation mechanisms for sensitive actions within the OT/ICS environment must be employed.
2-2-1-7
Requirement: Remote access to the OT/ICS networks must be restricted and exceptionally enabled when necessary and justified. A cybersecurity risk assessment must be conducted prior to granting a remote access and its associated risks are monitored and managed. The granted access must be through trusted multi-factor authenticated and encrypted channel for a defined period of time and with limited access privilege. The remote access session must be monitored and recorded while its time duration and granted user's privilege must be in accordance with the cybersecurity risk assessment.
2-2-1-8
Requirement: Secure and complex password standards must be implemented.
2-2-1-9
Requirement: Secure mechanisms to store OT/ICS assets' passwords must be used.
2-2-1-10
Requirement: With reference to the ECC subcontrol 2-2-3-5, users' identities and access rights must be reviewed in response to cybersecurity incidents, personnel roles changes, or whenever there is a change in OT/ICS system architecture.
2-2-1-11
Requirement: Access shall be immediately revoked when no longer needed.
References
- ECC – 2:2024 equivalent: 2-2-3
