CHAPTER 02

CONTROLLING ACCESS TO INFORMATION AND SYSTEMS

Section 0201

Controlling Access to Information and Systems

Managing Access Control Standards

Managing User Access

Securing Unattended Workstations

Managing Network Access Controls

Controlling Access to Operating System Software

Managing Passwords

Securing Against Unauthorized Physical Access

Restricting Access

Monitoring System Access and Use

Giving Access to Files and Documents

Managing Higher Risk System Access

Controlling Remote User Access

Types of Access Granted to Third Parties

Why access is granted to third parties

Access Control Framework

Access Policy

Controlled pathway

Node authentication

Diagnostic and Configuration Port Controls

Granting Access to Customers

Acceptable Usage of Information Assets

Management Duties

Third Party Service Management

Monitoring Third Party Services

Third Party Service Changes