IM-9 Secure user access to existing applications
Govern user access to legacy and non-native applications in hybrid environments using solutions such as an access security broker, application proxy or single sign-on.
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Proxy or broker configuration fronting those applications · Cloud console / configuration management
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Inventory of applications using legacy authentication · Policy repository / GRC workspace
- Conditional access or equivalent policy applied to that path · Policy repository / GRC workspace
- Plan and progress for retiring legacy authentication · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- legacy authentication endpoints left directly exposed
- no inventory so legacy protocols cannot be blocked safely
- broker deployed for some applications while direct paths remain open
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIM-8 Restrict the exposure of credential and secrets · IR-1 Preparation - update incident response plan and handling process