PR.AC-P4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties

Define, implement and evaluate processes, procedures and technical measures to manage archived keys in a secure repository requiring least privilege access, which include provisions for legal and regulatory requirements.

Catalogue and track all relevant physical and logical assets located at all of the CSP's sites within a secured system.

Develop systems, products, and business practices based upon a principle of security by design and industry best practices.

Establish, document, approve, communicate, implement, apply, evaluate and maintain policies and procedures for identity and access management. Review and update the policies and procedures at least annually.

Manage, store, and review the information of system identities, and level of access.

Employ the separation of duties principle when implementing information system access.

Employ the least privilege principle when implementing information system access.

Define and implement a user access provisioning process which authorizes, records, and communicates access changes to data and assets.

De-provision or respectively modify access of movers / leavers or system identity changes in a timely manner in order to effectively adopt and communicate identity and access management policies.

Review and revalidate user access for least privilege and separation of duties with a frequency that is commensurate with organizational risk tolerance.

Define, implement and evaluate processes, procedures and technical measures for the segregation of privileged access roles such that administrative access to data, encryption and key management capabilities and logging capabilities are distinct and separated.

Define and implement an access process to ensure privileged access roles and rights are granted for a time limited period, and implement procedures to prevent the culmination of segregated privileged access.

Define, implement and evaluate processes and procedures for customers to participate, where applicable, in the granting of access for agreed, high risk (as defined by the organizational risk assessment) privileged access roles.

Define, implement and evaluate processes, procedures and technical measures to ensure the logging infrastructure is read-only for all with write access, including privileged access roles, and that the ability to disable it is controlled through a procedure that ensures the segregation of duties and break glass procedures.

Define, implement and evaluate processes, procedures and technical measures to verify access to data and system functions is authorized.

Design, develop, deploy and configure applications and infrastructures such that CSP and CSC (tenant) user access and intra-tenant access is appropriately segmented and segregated, monitored and restricted from other tenants.

Define, implement and evaluate processes, procedures and technical measures to ensure the security and retention of audit logs.

Restrict audit logs access to authorized personnel and maintain records that provide unique access accountability.

The information system protects audit records from unauthorized access, modification, and deletion.

Define, implement and evaluate processes, procedures and technical measures to enforce policies and controls for all endpoints permitted to access systems and/or store, transmit, or process organizational data.

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.