IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.31 Documentation on authorised users and on
rights profiles
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Such documentation is to give a survey of the authorised users, user groups
and authorisation profiles and is a prerequisite for controls.
All of the following three means of providing documentation should be used:
- generic administration files provided by the system;
- individual files administered by the responsible administrator;
- hard copies.
In particular, the following are to be documented:
- authorised users, with the following details: assigned authorisation profile
(in the given case, deviation from the used standard authorisation profile);
reasons for selecting that particular authorisation profile (and any
deviations, where appropriate); where the user can be reached; time of, and
reason for, the configuration; any time limits;
- authorised groups, with the respective users; time of, and reason for, the
configuration, and time limit.
Additional controls:
- Have any records been made of the authorised users and groups and of
their authorisation profiles?
- Are the records up to date?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000