Trending Articles

Introduction IRDAI ICS Annexure III Item 10 requires that user accounts inactive beyond a defined threshold be automatically disabled. The operative word is automatically. A manual process where an IT administrator periodically reviews account activity reports and disables dormant accounts does not satisfy this requirement at the scale most insurance organisations operate. Automation is the … Continue reading IRDAI Item 10: Dormant Account Controls and the Automated Deprovisioning Requirement

Introduction ISO 27001:2022 Annex A.5.18 requires that access rights be reviewed at regular intervals and when employment or contractual changes occur. The control is one of the most consistently cited sources of nonconformities in ISO 27001 certification audits because organisations either do not conduct reviews on a defined cadence, conduct them informally without producing structured … Continue reading ISO 27001 A.5.18 Access Reviews: How to Implement With Structured Evidence

Introduction SOC 2 Trust Services Criteria CC5.1 requires that the entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. Segregation of duties is the primary control activity CC5.1 addresses for access governance. The criterion requires that incompatible functions be separated so that no … Continue reading SOC 2 CC5.1 Segregation of Duties: What Technical Enforcement Requires

Introduction SEBI CSCRF applies to all regulated entities but differentiates requirements by entity tier. Market Infrastructure Institutions face the highest requirements. Qualified Regulated Entities, defined by thresholds including trading volume, assets under management, number of clients, and systemic importance, face enhanced requirements above the baseline that apply to Mid-size and Small REs. Understanding which tier … Continue reading SEBI CSCRF and Qualified REs: What Higher-Tier Entities Must Implement

Introduction SEBI CSCRF PR.AA.S1(G1g) and PR.AA.S1(G1h) require that user accounts inactive beyond a defined threshold be automatically disabled and that departed users’ accounts be removed promptly. These are the access hygiene requirements within the broader PR.AA identity management sub-category, and they are consistently among the findings in SEBI CSCRF examinations at capital markets entities. Dormant … Continue reading Dormant Account Controls Under SEBI CSCRF: The Access Hygiene Requirement

Introduction ISO 27001:2022 Annex A.8.2 requires that the allocation and use of privileged access rights be restricted, controlled, and reviewed. The control is one of the most audit-intensive in the standard because privileged access failures are disproportionately represented in the security incidents that drive ISO 27001 certification in the first place. Organisations pursuing certification almost … Continue reading ISO 27001 A.8.2: Privileged Access Management Requirements and Implementation

Introduction ISO 27001:2022 introduced A.8.16 as a new control with no direct equivalent in the 2013 version. The control requires that networks, systems, and applications be monitored for anomalous behaviour and that appropriate actions be taken when anomalies are detected. The 2022 revision’s addition of A.8.16 reflects a deliberate shift in the standard’s monitoring posture: … Continue reading ISO 27001 Continuous Monitoring: What the 2022 Update Added to Your IAM Obligations

Introduction SEBI CSCRF GV.OC.S2(G3) requires that logs, user details, and application data be accessible to SEBI on demand. This is not a notification requirement or a periodic reporting obligation. It is a structural requirement about log architecture: the infrastructure must be capable of producing structured exports of any requested data for any requested period at … Continue reading SEBI On-Demand Log Access: What GV.OC.S2(G3) Requires From Your IAM Architecture

Introduction GDPR consent requirements are specific, technically demanding, and frequently misimplemented. Article 6 establishes consent as one of six lawful bases for processing. Article 7 sets the conditions that make consent valid. Article 9 imposes additional requirements for consent to process special category data. Together, they define a consent infrastructure standard that goes significantly beyond … Continue reading GDPR Consent Management: What Articles 6, 7, and 9 Require Technically