Policy 7230A - Department of Administration

4. Access Control
These Assessment and Planning Non-Mandatory Baselines support the Enterprise Security
Policy (ITEC 7230 Rev 1) and the Default Security Requirements (ITEC 7230A).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
4. Access Control
4.1. Identification and Authentication
4.1.1. Manage Identification and Authentication (6 sets) (4 sets)
4.2. Account Management
4.2.1. Configure User Accounts (4 sets) (2 sets)
4.3. Session Management
4.3.1. Configure Systems for Secure Access (6 sets) (3 sets)
4.3.2. Configure Systems for Secure Communications (3 sets) (1 set)
4.4. Maintain Records
4.1. Identification and Authentication
No applicable Non-Mandatory Baselines.
4.2. Account Management
The following are the Non-Mandatory Baselines that support the Account
Management section of the Default Security Requirements:
4.2.1. Configure User Accounts
Agencies should establish the system accounts that will be used to access the
system in a manner that promotes and enhances security while maintaining
business functionality:
4.2.1.a Account Permissions and Restrictions Scheme
• Accounts should be created with the following restrictions, by
position, where applicable:
o System administrative access (install, configure, modify
and patch system software).
o Account administrative access (create, delete, modify
accounts and permissions).
o Review administrative access (review activities of other
administrators).
o Full content access (read, write, edit and delete data).
o Limited content access (read, write and edit data).
o Restricted content access (read and write data).
o Minimal content access (read data).
4.2.1.b Account Review Scheduling and Frequency
• Accounts should be reviewed to determine appropriateness of
the accounts and the permissions of those accounts on a tri-
7