[non-validated] DORA SFS 3 / SF 2: Access Management Controls per Articles 9 and 15
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT service provider implemented documented access management controls requiring multiple verification steps and restricted user permissions as mandated by DORA Articles 9 and 15?
Explanation
[non-validated] Requires designated critical ICT service providers to maintain documented access management policies with multi-factor authentication and least privilege access controls for sensitive operational data, as specified in DORA Articles 9 and 15.
Criterion and evidence
Actor: Designated critical ICT third-party service providers under Regulation (EU) 2022/2554. Scope: ICT systems processing sensitive operational data within critical functions. Evidence period: Current review period (ongoing verification). Required evidence: Documented identity and access management policy specifying user provisioning, de-provisioning, and privileged access controls; Evidence of implemented multi-factor authentication for remote access and privileged accounts; Records demonstrating regular review of user access rights and adherence to least privilege principle. Negative criterion: Absence of documented evidence demonstrating required controls. Missing evidence: Pending verification when evidence is unavailable or incomplete. Alternatives: No alternatives satisfy the criterion; DORA Articles 9 and 15 mandate specific controls for identity and access management
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence is required to satisfy this criterion?
Documented identity and access management policy specifying user provisioning, de-provisioning, and privileged access controls; evidence of implemented multi-factor authentication for remote and privileged accounts; records demonstrating regular access rights reviews adhering to least privilege principle.
How are missing evidence scenarios handled?
Verification remains pending when evidence is unavailable or incomplete; absence of evidence does not constitute automatic failure but requires documentation submission.
References
DORA: Protection, access and data security