Cyber Essentials - User Access Control

Cyber Essentials is a UK government-backed certification scheme that aims to help organizations protect themselves against common cyber threats, and one of the key controls it addresses is user access control.

To meet the Cyber Essentials control for user access control, organizations need to implement certain security controls and practices to ensure that only authorized users are able to access systems and sensitive information. Here are some steps that organizations can take to meet the Cyber Essentials control for user access control:

  1. Develop access control policies: The first step in user access control is to develop policies and procedures for controlling access to systems and sensitive information. This should include policies for user account management, password policies, and procedures for granting and revoking access.
  2. Implement technical controls: Technical controls such as firewalls, intrusion detection systems, and intrusion prevention systems can be used to protect your systems and network from unauthorized access. Additionally, implement secure protocols such as SSH and SFTP, instead of FTP or Telnet.
  3. Implement multi-factor authentication: Multi-factor authentication (MFA) can help to ensure that only authorized users are able to access systems and sensitive information. This includes using a combination of something the user knows (password), something the user has (token) and something the user is (biometrics).
  4. Train your staff: Your staff plays a crucial role in user access control. All employees should be made aware of the access control policies and procedures and be trained on how to follow them. In addition, regular training should be provided on security awareness and the appropriate handling of sensitive information.
  5. Monitor and review access: Regularly monitor and review user access to systems and sensitive information to ensure that access is being used appropriately and that any necessary adjustments can be made. This can be done through regular audits and user access reviews.
  6. Continuously improve: Continuously review and improve user access control policies and procedures by regularly analyzing incidents, identifying trends, and making changes as necessary. This allows organizations to stay up-to-date with the latest security threats and respond accordingly.

By following these steps, organizations can meet the Cyber Essentials control for user access control and ensure that only authorized users are able to access systems and sensitive information. Keep in mind that user access control is an ongoing process that needs to be regularly reviewed and updated to reflect the changing needs of the organization and to adapt to new risks and threats.

‍

More from our security wiki

Continuous learning for your organisation, our knowledge base to help you grow

Cyber Essentials Self Assessment: Password-Based Authentication
This security wiki provides guidelines for implementing password-based authentication practices within your organisation. Follow these recommendations to enhance the security of user accounts and protect against unauthorised access.
Cyber Essentials Self Assessment: Administrative Accounts
This security wiki provides guidelines for the proper management and control of administrative accounts within your organisation. Follow these recommendations to establish secure administrative account practices.
Cyber Essentials Self Assessment: Malware Protection
This security wiki provides guidelines for implementing malware protection measures across your organisation's devices. Follow these recommendations to safeguard your desktop computers, laptops, tablets, and mobile phones from malware threats.
Cyber Essentials Self Assessment: Security Update Management
This security wiki provides guidelines for effective security update management to ensure that your organisation's devices and software remain protected against known vulnerabilities. Follow the recommendations below to establish a robust security update management process.
Cyber Essentials Self Assessment: Device Locking
This security wiki provides guidelines for implementing device locking mechanisms to enhance the security of your organisation's devices. Follow the recommendations below to protect against unauthorised access to software and services.
Cyber Essentials Self Assessment: Secure Configuration
This security wiki provides guidelines for achieving secure configuration of devices and services within your organisation. Follow the recommendations below to minimise potential vulnerabilities and enhance the overall security posture.
Now we're partners, you have unlocked:
Threat reports
1 Vuln scan
Security Wiki
Templates
Cyber Essentials logoCyber Essentials logo
©Periculo
Your Security Partner