Directory Service
What is Directory Service?
A centralized database that stores, organizes, and provides access to information about network resources and users for authentication and authorization.
Frameworks that govern directory service
What the standards actually require on directory service
Requirements naming directory service across 6 standards, quoted from the control text.
Security-relevant events for Microsoft AD DS domain controllers, Microsoft AD CS CA servers, Microsoft AD FS servers and Microsoft Entra Connect servers are centrally logged.
ISM-1830 · Central logging of Active Directory services events →Ensures that general directory services are operated securely and that the information processed with them is appropriately protected.
bsi-it-grundschutz::APP.2.1 · APP.2.1 Allgemeiner Verzeichnisdienst (General Directory Service) →Where supported, control access to all enterprise assets centrally, using a directory service or an SSO provider.
CIS-6.7 · Centralize Access Control →Security Layer 3 Applications per X.805 Clause 7.3: The Applications Security Layer covers what is required of the applications that service provider customers reach over the network.
X805-Layer3-Applications-Security-Email-Web-Directory-File-Transfer-E-Commerce-Video · ITU-T X.805 Security Layer 3 - Applications Security + Email + Web + Directory + File Transfer + E-Commerce + Video Conferencing + IM + Office Collaboration + SaaS + B2B EDI + Mobile Apps + APIs →This point pulls together the authentication and communications controls the Directive names explicitly. Multi-factor authentication, or continuous authentication solutions in its place, is expected where appropriate, and the interesting question is always cov...
nis2-directive::Art.21.2.j · Multi-factor or continuous authentication, secured communications and secured emergency communications →Where an agency installs a VoIP phone in a shared area or lobby, it should limit or disable that phone's access to data networks and its voice mail and directory service functions, and should put the phone on a separate network segment.
new-zealand-information-security-manual-nzism::18.3.15.C.01 · 18.3.15.C.01 Restrict VoIP phones in lobbies and shared areas →Questions people ask about directory service
What is Directory Service?
Why is Directory Service important for compliance?
Which compliance frameworks address Directory Service?
Where can I learn more about Directory Service?
See how Directory Service applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.