Privileged access is just-in-time and reviewed

Administrative access to AWS, Azure, Entra ID and SAP is granted just-in-time through PIM / firefighter IDs with approval, MFA and session logging; no standing admin access exists outside break-glass accounts.

Requirements

ISO-A.8.2 A.8.2 · Privileged access rights

ITGC-AM-02 ITGC-AM-02 · Privileged / superuser access is restricted and monitored

RBI-CSF-NBFC-Annex-1-2 RBI-CSF-NBFC Annex 1 §2 · Cyber security — SOC monitoring, vulnerability management, incident reporting (RBI Cyber Security Framework for NBFCs (IT Framework for the NBFC Sector))

RBI-ITGRCA-2023-7.1 RBI-ITGRCA-2023 §7.1 · Access control — least privilege, privileged access management, periodic review (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)

SOC2-CC6.1 CC6.1 · Logical access security software, infrastructure and architectures

SOC2-CC6.3 CC6.3 · Role-based access, least privilege and segregation of duties; access modification and removal

Policy

pol-access · Access Control Policy

Applications

Amazon Web Services (ap-south-1)Microsoft Entra IDSAP S/4HANA

Third parties

—

Testing procedure

Entra PIM, AWS IAM Identity Center temporary elevation (TEAM), SAP GRC firefighter. Tests: Microsoft Entra ID: No permanent Global Administrator assignments; Amazon Web Services (ap-south-1): No standing AdministratorAccess permission sets; SAP S/4HANA: Firefighter sessions reviewed. Frequency continuous.