GRC Keamanan Siber 18 butir
Identity & Privileged Access Management (IAM/PAM) Audit
Daftar periksa ini dalam bahasa Inggris.
Audits the identity lifecycle, authentication controls, and privileged access management for administrative and service accounts across on-premises and cloud systems.
CIS v8NIST 800-53ISO 27001
PDF atau Word gratis · masukkan email Anda untuk mengunduh.
Identity Lifecycle
- Is there a documented joiner-mover-leaver process governing account provisioning and deprovisioning? *
- Are accounts disabled or removed within a defined SLA after termination or role change? *
- Is a centralized identity provider or directory used as the authoritative source for accounts? *
- Are access rights recertified through periodic user access reviews? *
- How frequently are user access reviews performed?
Authentication Controls
- Is multi-factor authentication enforced for all remote and administrative access? *
- Is MFA enforced for externally exposed applications and cloud consoles? *
- Are password policies aligned with NIST 800-63B (length, screening against breach lists)? *
- Are phishing-resistant authenticators (FIDO2/WebAuthn) used for privileged users?
Privileged Access Management
- Are privileged accounts inventoried and separated from standard user accounts? *
- Are privileged credentials stored and rotated in a PAM vault? *
- Is just-in-time or time-bound elevation used instead of standing privileges? *
- Are privileged sessions recorded and monitored? *
- Are dedicated administrative workstations used for privileged tasks?
Service & Non-Human Accounts
- Are service accounts inventoried with a documented owner and purpose? *
- Are service account secrets rotated on a defined schedule? *
- Are default vendor accounts and passwords changed or disabled? *
- Are interactive logons for service accounts prohibited?
Unduh daftar periksa Identity & Privileged Access Management (IAM/PAM) Audit lengkap
Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.