Access Control Policy
In reviewPending your approvalChange reason CAPA-024 Add MFA requirement for local privileged access (FND-031)4.3Multifactor authentication
MFA is required for all remote access and for network access to privileged accounts.network access and for local and network access to privileged accounts, including console logons to servers in the CUI enclave. Approved factors include authenticator apps, hardware keys and SMS codes.Phishing-resistant authenticators (FIDO2) are required for administrators. SMS codes are not an approved factor.
Matches CAPA-024 action A2 and closes the gap auditors raised on 3.5.3[b].
4.5Access reviews
Asset owners review user access to CUI systems twice a year.quarterly and privileged access monthly. Reviews are signed off in AegisERM; email sign-off is not accepted as evidence.
Can Quality keep twice-a-year for non-CUI systems? Otherwise OK.
5Requirements addressed
3.1.1, 3.1.2, 3.1.5, 3.1.12, 3.5.3, A.5.15, A.5.18, A.8.5