Safeguard 6.1 Establish an access granting process
A documented, preferably automated process for granting access when a user joins or changes role, and the CSF 2.0 Govern subcategory on human resources practices that CIS maps it to.
Control 6 Access control management
CIS Control 6 Safeguards for granting and removing access: access granting and revoking processes, MFA for external applications, remote access and administrators, an inventory of identity systems, centralized access control and role-based access control.
Safeguard 6.2 Establish an access revoking process
A preferably automated process that revokes access immediately on termination, rights revocation or role change, disabling rather than deleting accounts where audit trails must be kept.
Safeguard 6.3 Require MFA for externally-exposed applications
MFA on every internet-facing enterprise or third-party application where supported, with MFA enforced centrally by a directory or SSO service accepted as meeting the Safeguard.
Safeguard 6.4 Require MFA for remote network access
MFA for all remote access to the enterprise network: one of three IG1 MFA Safeguards in Control 6, alongside externally exposed applications (6.3) and administrative access (6.5).
Safeguard 6.5 Require MFA for administrative access
MFA on all administrative accounts on every enterprise asset where supported, including assets run by a service provider.
Safeguard 6.6 Establish and maintain an inventory of authentication and authorization systems
An inventory of the systems that authenticate and authorize users, hosted on site or at service providers, reviewed at least annually: the Control 6 Safeguard in the Software asset class.
Safeguard 6.7 Centralize access control
Running access control for every enterprise asset from a central directory or SSO service where supported, as distinct from Safeguard 5.6, which centralizes account management.
Safeguard 6.8 Define and maintain role-based access control
Role-based access control with documented access rights for each role and access reviews at least annually: the IG3 Safeguard in Control 6, assigned to the Govern function.
