CERT Resilience Management Model, Version 1.0

access controls current and reflective of actual business and resilience requirements. TheAccess Management process area establishes processes to ensure that access toorganizational assets remains consistent with the business and resilience requirements ofthose assets even as the organization’s operating environment changes. At a summary level,this includes activities toinvolve owners of assets in the process of establishing and maintaining access privilegesmanage changes to access privileges as the identities, user roles, businessrequirements, and resilience requirements changemonitor and analyze relationships between identities, roles, and current access privilegesto ensure alignment with business and resilience requirementsadjust access privileges when they are not aligned with business and resiliencerequirementsensure that the access privileges granted to a user by the system of access controlsreflect the privileges assigned by the asset ownerClearly, access management is strongly tied to identity management. In identitymanagement, persons, objects, and entities are established as identities that may requiresome level of access to organizational assets. However, access privileges and restrictionsare tied to identities by the roles that are attributed to the identity. Thus, as identities change,or as their roles change, there is a cascading effect on access privileges that must bemanaged. For example,new identities may be established that must be provided access privilegesthe access privileges of existing identities may have to be changed as the jobresponsibilities associated with the identity changethe access privileges of existing identities may need to be eliminated or deprovisioned asjob responsibilities expire (either through new assignments or voluntary or involuntarytermination)The selection of the appropriate access controls to enforce those rights for a given asset isoutside of the scope of this process area. These activities are performed in the operationsprocess area associated with each type of asset (e.g., Knowledge and InformationManagement for information assets). Overall management of the organization’s internalcontrol system is addressed in the Controls Management process area.Related Process AreasThe creation, maintenance, and deprovisioning of identities and their associated attributes isaddressed in the Identity Management process area.The selection and implementation of appropriate access controls for assets is addressed inthe Knowledge and Information Management process area (for information), TechnologyManagement process area (for technology assets), and the Environmental Control processarea (for facilities).The analysis and mitigation of risks related to inappropriate or excessive levels of accessprivileges is addressed in the Risk Management process area.107 | CMU/SEI-2010-TR-012