8.2.4 Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows: • Authorized with the appropriate approval. • Implemented with only the privileges specified on the documented approval
Addition, deletion, and modification of user IDs, authentication factors, and other identifier objects are managed as follows: • Authorized with the appropriate approval. • Implemented with only the privileges specified .
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- System settings and account records showing the privileges implemented match those on the documented approval · Identity provider / directory
- Records showing a modification request was refused or altered before implementation · Document repository
periodic reviewEvidence produced at each review
- Evidence lifecycle events are logged, so an unauthorised change would be visible · Document repository
governing documentDocuments that govern the control
- Documented authorisations covering additions, modifications and deletions of user IDs, authentication factors and identifier objects · Policy repository / GRC workspace
- A sample walk through comparing an approval to the resulting account state · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Approval covers the addition while later modifications proceed on informal request
- Implemented privileges exceed the documented approval, and nothing compares the two
- Deletions performed without record, so it cannot be shown when access ended
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.3 Additional requirement for service providers only: Service providers with remote access to customer premises use unique authentication factors for each customer premises · 8.2.5 Access for terminated users is immediately revoked