7.1.1 Are access needs for each role defined, including: Examine and access needs System components and data resources that each role needs to access for their job function? of privilege required (for example, user, administrator, etc.) for accessing resources? 7.1.2 Is access to privileged user IDs restricted as follows: Interview personnel To least privileges necessary to perform job Interview management responsibilities? Review privileged user IDs Assigned only to roles that specifically require that privileged access? 7.1.3 Is access assigned based on individual personnel’s job Interview management classification and function? Review user IDs 7.1.4 Is documented approval by authorized parties required, Review user IDs specifying required privileges? Compare with documented approvals Compare assigned privileges with documented approvals 7.2 Is an access control system(s) in place for system components to restrict access based on a user’s need to know, and is it set to all” unless specifically allowed, “deny as follows: 7.2.1 Is the access control system(s) in place on all system Review vendor documentation components? Examine configuration settings 7.2.2 Is the access control system(s) configured to enforce Review vendor documentation privileges assigned to individuals based on job Examine configuration classification and function? settings
7.1.1 Are access needs for each role defined, including: System components and data resources that each role needs to access for their job function? of privilege required (for example, user, administrator, etc.) for accessing resources? Examine and access needs 7.1.2 Is access to privileged user IDs restricted as follows: To least privileges necessary to perform job responsibilities? Assigned only to roles that specifically require that privileged access? Interview personnel Interview management Review privileged user IDs 7.1.3 Is access assigned based on individual personnel’s job classification and function? Interview management Review user IDs 7.1.4 Is documented approval by authorized parties required, specifying required privileges? Review user IDs Compare with documented approvals Compare assigned privileges with documented approvals 7.2 Is an access control system(s) in place for system components to restrict access based on a user’s need to know, and is it set to “deny all” unless specifically allowed, as follows: 7.2.1 Is the access control system(s) in place on all system components? Review vendor documentation Examine configuration settings 7.2.2 Is the access control system(s) configured to enforce privileges assigned to individuals based on job classification and function? Review vendor documentation Examine configuration settings