PA-8 Determine access process for cloud provider support
Establish an approval process and secure access path for cloud provider support requests that involve temporary access to organisational data.
4
artefacts
2
held by a system
1
at each review
easy
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Customer lockbox or equivalent configuration and approver list · Vendor register / contract repository
- Log of support access requests, approvers and durations · SIEM / log platform
periodic reviewEvidence produced at each review
- Post-access review records · Identity provider / directory
governing documentDocuments that govern the control
- Documented approval process for provider support access · Vendor register / contract repository
First move
Automate the pull from your Vendor register / contract repository. Vendor register with review dates and attached assurance reports; expiry-driven reminders, not an annual scramble.
Common gaps auditors find
- support access approved ad hoc by whoever is on the ticket
- lockbox capability available but not enabled
- no record of what the provider accessed or for how long
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPA-7 Follow just enough administration (least privilege) principle · PV-1 Define and establish secure configurations