Certified Information Systems Auditor (CISA) | Domain 5 Information Security and Access Protection 01

A policy must set a direction grounded in the business and its risks and be taken down into standards, procedures and controls.

The information owner understands the value, the sensitivity and the legal requirements and decides the classification and protection requirements.

Keep data only as long as needed and dispose of it securely once legal holds and business purposes are satisfied.

Disabling access immediately, triggered by HR information, prevents unauthorised access after departure.

RBAC manages permissions through job roles, which standardises granting and review.

Limit privileged use to when it is needed and secure approval and traceability.

It combines different kinds of factor, such as something you know and something you have.

The authentication platform becomes a single critical point, so strong authentication, availability and monitoring are needed.

Federation links identity information across different domains on the basis of a trust relationship.

A mantrap does not open the next door until the previous one has closed and authentication has succeeded, which deters tailgating.

The security of encryption depends on the generation, storage, distribution, renewal, revocation and recovery of the keys.

DLP controls the leakage of confidential information on the basis of content, classification, channel and so on.

Pseudonymisation lowers the risk, but the possibility of re-identification remains, so appropriate protection is still needed.