5.15
Access Control
Establish and implement access control rules for physical and logical access to the information based on business and security needs.
-
5.8.3.3 The organization shall only permit administrator accounts to perform administrative activities (and not user-level activities such as accessing email or browsing the web).
5.8.3.4 The organization should consider the implementation of a centralized authorization control system.
6.2.3.1 (d) The organization using cloud applications and/or outsourcing IT services shall:
a. Require that all their cloud service providers share an AICPA SSAE 18 or equivalent report that states that they achieved Trust Service Principles compliance or provide a documented business case as
why they chose not to;
NOTE: The organization determines equivalence to AICPA SSAE 18.
b. Evaluate their risk tolerance level with the legal jurisdictions where their outsourced providers store or use their sensitive information;
c. Ensure that their IT infrastructure and users communicate securely with all cloud services and applications; and
d. Ensure that administrative accounts for cloud services use multi-factor authentication and differ from internal administrator accounts. -
-