GRC в кибербезопасности Пунктов: 18
Identity & Privileged Access Management (IAM/PAM) Audit
Этот чек-лист на английском языке.
Audits the identity lifecycle, authentication controls, and privileged access management for administrative and service accounts across on-premises and cloud systems.
CIS v8NIST 800-53ISO 27001
Бесплатно в PDF или Word · укажите email, чтобы скачать.
Identity Lifecycle
- Is there a documented joiner-mover-leaver process governing account provisioning and deprovisioning? *
- Are accounts disabled or removed within a defined SLA after termination or role change? *
- Is a centralized identity provider or directory used as the authoritative source for accounts? *
- Are access rights recertified through periodic user access reviews? *
- How frequently are user access reviews performed?
Authentication Controls
- Is multi-factor authentication enforced for all remote and administrative access? *
- Is MFA enforced for externally exposed applications and cloud consoles? *
- Are password policies aligned with NIST 800-63B (length, screening against breach lists)? *
- Are phishing-resistant authenticators (FIDO2/WebAuthn) used for privileged users?
Privileged Access Management
- Are privileged accounts inventoried and separated from standard user accounts? *
- Are privileged credentials stored and rotated in a PAM vault? *
- Is just-in-time or time-bound elevation used instead of standing privileges? *
- Are privileged sessions recorded and monitored? *
- Are dedicated administrative workstations used for privileged tasks?
Service & Non-Human Accounts
- Are service accounts inventoried with a documented owner and purpose? *
- Are service account secrets rotated on a defined schedule? *
- Are default vendor accounts and passwords changed or disabled? *
- Are interactive logons for service accounts prohibited?
Скачайте полный чек-лист «Identity & Privileged Access Management (IAM/PAM) Audit»
Получите его бесплатно в виде аккуратного PDF для печати или редактируемого документа Word.