Requirement
The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.
Points of Focus
Identifies and Manages the Inventory of Information Assets
Requirement: The entity identifies, inventories, classifies, and manages information assets (for example, infrastructure, software, and data).
Assesses New Architectures
Requirement: The entity identifies new system architectures and assesses their security prior to implementation into the system environment.
Restricts Logical Access
Requirement: The entity restricts logical access to information assets, including infrastructure (for example, server, storage, network elements, APIs, and endpoint devices), software, and data (at rest, during processing, or in transmission) through the use of access control software, rule sets, and standard configuration hardening processes.
Identifies and Authenticates Users
Requirement: The entity identifies and authenticates persons, infrastructure, and software prior to accessing information assets, whether locally or remotely. The entity uses more complex or advanced user authentication techniques such as multifactor authentication when such protections are deemed appropriate based on its risk mitigation strategy.
Considers Network Segmentation
Requirement: The entity uses network segmentation, zero trust architectures, and other techniques to isolate unrelated portions of the entity's information technology from each other based on the entity’s risk mitigation strategy.
Manages Points of Access
Requirement: Points of access by outside entities and the types of data that flow through the points of access are identified, inventoried, and managed. The types of individuals and systems using each point of access are identified, documented, and managed.
Restricts Access to Information Assets
Requirement: Combinations of data classification, separate data structures, port restrictions, access protocol restrictions, user identification, and digital certificates are used to establish access control rules and configuration standards for information assets.
Manages Identification and Authentication
Requirement: Identification and authentication requirements are established, documented, and managed for individuals and systems accessing entity information, infrastructure, and software.
Manages Credentials for Infrastructure and Software
Requirement: New internal and external infrastructure and software are registered, authorized, and documented prior to being granted access credentials and implemented on the network or access point. Credentials are removed and access is disabled when access is no longer required or the infrastructure and software are no longer in use.
Uses Encryption to Protect Data
Requirement: The entity uses encryption to protect data (at rest, during processing, or in transmission), when such protections are deemed appropriate based on the entity’s risk mitigation strategy.
Protects Cryptographic Keys
Requirement: The entity protects cryptographic keys during generation, storage, use, and destruction. Cryptographic modules, algorithms, key lengths, and architectures are appropriate based on the entity’s risk mitigation strategy.
[C] Restricts Access to and Use of Confidential Information for Identified Purposes
Requirement: Logical access to and use of confidential information is restricted to identified purposes.
[P] Restricts Access to and the Use of Personal Information
Requirement: Logical access to and use of personal information is restricted to authorized personnel who require such access to fulfill the identified purposes to support the achievement of the entity’s objectives related to privacy.
Explanation
This criterion covers the technical foundation of security: access control software, hardened configurations, authentication, network segmentation, and encryption that keep information assets safe. Auditors examine how the entity knows what assets it has, how access to them is technically enforced, and whether encryption and key management match the entity's risk strategy.
