We all know that logical access is a very important control for any organisation, especially for companies that are having a lot of IT applications. Given below are some pointers in establishing a robust IT risk, logical access framework. These have been aligned to SSE  /  SOC Trust Service Principles.

1. Assets are assigned owners who are responsible for evaluating access
2. Online applications require customers to have ID and password. Requests for access to online applications require the matching of the customer ID against a list of privileges each user possesses when granted access to the system initially.
3. Systems are required to be implemented with unique user ID and password submission
4. External access to company network by employees is permitted only through a two factor authentication or through encrypted & authenticated means.
5. Privileged access to sensitive resources is restricted to defined user roles and access to these roles must be approved by the designated approver.
6. All access is given against approved access request (either paper or electronic)
7. System security is configured to require users to change their password upon initial sign-on and every 90 days thereafter.
8. Password complexity standards are established to enforce control over access control software passwords.
9. Account sharing is prohibited unless a variance from policy is granted in writing by the company’s designated officer.
10. Infrastructure and software is hardened and have a configuration that includes requirements for implementation of access control software.
11. Transmission of digital output beyond the boundary of the system occurs through the use of authorized software supporting the advanced encryption standard (AES).
12. VPN, SSL, secure file transfer program (SFTP), and other encryption technologies are used for defined points of connectivity and to protect communications between the processing center and users connecting to the processing center from within or external to customer networks.
13. Storage for key workstations and laptops is encrypted. Removable media for workstations and laptops are encrypted
14. Access to data is restricted to authorized applications through access control software. Access rules are created and maintained by information security personnel during the application development process.
15. Logical access to data other than through authorized application is restricted to administrators through database management system native security
16. Application security restricts output to approved roles or user IDs.
17. Backup media are encrypted during creation.
18. The ability to install software on workstations, laptops & other systems  is restricted to IT support personnel.
19. A role based security process has been defined with an access control system that is required to use roles when possible.