Requirement · RBI-ITGRCA-2023-7.1
RBI-ITGRCA-2023 §7.1 · Access control — least privilege, privileged access management, periodic review (RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 2023)
Controls (7)
| Control | Name | Domain |
|---|---|---|
| ACC-01 | MFA and SSO enforced for workforce access | Access Control |
| ACC-02 | User access provisioning is approved before grant | Access Control |
| ACC-03 | Privileged access is just-in-time and reviewed | Access Control |
| ACC-04 | Quarterly user access review of in-scope applications | Access Control |
| JML-01 | Leavers are de-provisioned within 24 hours | Joiner/Mover/Leaver |
| JML-02 | Mover access is recertified on role change | Joiner/Mover/Leaver |
| SOD-01 | Segregation of incompatible duties in SAP | Segregation of Duties |