[non-validated] Least Privilege Access Controls (DORA SFS 3E)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity implemented documented least privilege access controls for ICT systems as defined in the repository's 'DORA: Protection, access and data security' topic boundaries?
Explanation
[non-validated] Entities subject to DORA must implement documented least privilege access controls for ICT systems, ensuring users and processes have only necessary permissions to safeguard systems and data against unauthorized access.
Criterion and evidence
Verify entity role applicability and documented implementation of least privilege access controls per repository topic description. Evidence period: current review period. Applies standard/simplified framework per DORA topic boundaries. Covers position 3E specifically within the 'Protection, access and data security' scope.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Protection, access and data security. Protect ICT systems and information through proportionate access, data and network safeguards. Cover identity and access controls, authentication, least privilege, cryptography, data security, physical/environmental safeguards and network segregation. Apply the relevant standard or simplified framework. SFS 4 owns change/patch lifecycle; SFS 5 owns detection. DORA article references: 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence is required to satisfy this requirement?
Documented evidence of implemented least privilege access controls (e.g., role definitions, permission assignments) meeting the repository topic description. Implementation under the simplified framework is an acceptable alternative.
How is missing evidence handled?
The evidence request remains pending; absence of documented evidence does not constitute automatic failure.
References
DORA: Protection, access and data security