User Access Review

Recertify user access against least privilege and separation of duties at a frequency set by the organisation's risk tolerance, and withdraw what is no longer justified.

Baseline control principles for access control (required of every AI (minimum for a low inherent risk)). Identification and authentication govern access to systems, applications and hardware;

Logging and monitoring: a process follows every access to the network and to system components. Level 1 (a to h): audit trails of what privileged administrators do on every system and network component; fault logging; logging of changes; event logging;