Podcast
Questions and Answers
The Password and Access Control Policy applies to all systems and assets owned, managed, or operated by the company.
The Password and Access Control Policy applies to all systems and assets owned, managed, or operated by the company.
True
The HR role/line manager is responsible for informing IT of new employees, changes to access rights, and leavers.
The HR role/line manager is responsible for informing IT of new employees, changes to access rights, and leavers.
True
The Information Security Manager approves access requests and audits user and access lists on a quarterly basis.
The Information Security Manager approves access requests and audits user and access lists on a quarterly basis.
True
Systems Administrators must adhere to the policy when making changes to access privileges and ensure systems enforce the configurations in the policy.
Systems Administrators must adhere to the policy when making changes to access privileges and ensure systems enforce the configurations in the policy.
Signup and view all the answers
User authentication is only based on job classification and function, without considering the principle of least privilege and need-to-know basis.
User authentication is only based on job classification and function, without considering the principle of least privilege and need-to-know basis.
Signup and view all the answers
Non-authenticated and shared/group user IDs are allowed, and users are not required to have a unique user ID and personal secret password.
Non-authenticated and shared/group user IDs are allowed, and users are not required to have a unique user ID and personal secret password.
Signup and view all the answers
Different authentication mechanisms are not required for user, operating system, web, voice, email, fax, white mail, remote access, and network device authentication.
Different authentication mechanisms are not required for user, operating system, web, voice, email, fax, white mail, remote access, and network device authentication.
Signup and view all the answers
Passwords must be at least 8 characters with a mix of upper and lower case letters, numbers, and special characters.
Passwords must be at least 8 characters with a mix of upper and lower case letters, numbers, and special characters.
Signup and view all the answers
Vendor remote access accounts should not be monitored, passwords changed regularly, and unused accounts deactivated.
Vendor remote access accounts should not be monitored, passwords changed regularly, and unused accounts deactivated.
Signup and view all the answers
Study Notes
Password and Access Control Policy Document Control Summary
- The Password and Access Control Policy sets out specific responsibilities, conditions, and practices to minimize risks and protect physical assets and sensitive information.
- The policy applies to all systems and assets owned, managed, or operated by the company.
- The HR role/line manager is responsible for informing IT of new employees, changes to access rights, and leavers.
- The Information Security Manager approves access requests and audits user and access lists on a quarterly basis.
- Systems Administrators must adhere to the policy when making changes to access privileges and ensure systems enforce the configurations in the policy.
- User authentication is based on job classification and function, with the principle of least privilege and need-to-know basis.
- Non-authenticated and shared/group user IDs are prohibited, and every user must have a unique user ID and personal secret password.
- Different authentication mechanisms are required for user, operating system, web, voice, email, fax, white mail, remote access, and network device authentication.
- Passwords must not be shared, must be at least 8 characters with a mix of upper and lower case letters, numbers, and special characters.
- Password history is maintained, password lockout and duration are set, and remote access should utilize two-factor authentication.
- Vendor remote access accounts should be monitored, passwords changed regularly, and unused accounts deactivated.
- Violations of the policy may result in disciplinary action, and deviations require a valid business case reviewed and approved by the Security Management Team and/or Legal Counsel.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Explore the key points of a Password and Access Control Policy document, focusing on responsibilities, access request approvals, user authentication, password requirements, and consequences for policy violations.
