Policy 7230A - Department of Administration

4. Access Control
These Assessment and Planning Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1) and the Default Security Requirements (ITEC 7230A).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
4. Access Control
4.1. Identification and Authentication
4.1.1. Manage Identification and Authentication (6 sets) (4 sets)
4.2. Account Management
4.2.1. Configure User Accounts (4 sets) (2 sets)
4.3. Session Management
4.3.1. Configure Systems for Secure Access (6 sets) (3 sets)
4.3.2. Configure Systems for Secure Communications (3 sets) (1 set)
4.4. Maintain Records
4.1. Identification and Authentication
The following are the Mandatory Baselines that support the Identification and
Authentication section of the Default Security Requirements:
4.1.1. Manage Identification and Authentication
Agencies must ensure that only individuals that have the pre-established right to
access systems can do so:
4.1.1.a Identity Verification
• Users must be identified with government issued identifiers
that include the following information:
o Full name.
o Signature.
o Photograph.
4.1.1.b User ID Construction
• User identifiers (User IDs) must be constructed in a consistent
manner.
4.1.1.c User Authenticator Construction
• Where passwords are used as user authenticators their length
and the character sets from which they are constructed must
be determined by the risk categorization of the system:
o Very high and high risk systems must have passwords
at least twelve characters in length that make use of all
four of upper case letters, lower case letters, numbers,
and special characters.
o Medium risk systems must have passwords at least
eight characters in length that make use of three of the
Mandatory Baselines
Page 7 of 25