Review of Access Rights
Certification criterion
A record shall be kept of the registration/use/deletion of user accounts that access information systems and personal information and important information, and of the granting/change/deletion of access rights, and this record shall be reviewed periodically to check whether the accounts and access rights are appropriate.
Key checkpoints
- Are records kept of the creation/registration/granting/use/change/revocation of user accounts and access rights for information systems and personal information and important information?
- Have criteria, review bodies, review methods, cycles, and so on for reviewing the adequacy of user accounts and access rights for information systems and personal information and important information been established, and are periodic reviews carried out?
- Where the access rights review reveals problems such as excessive granting of access rights, non-compliance with the authorization procedure, or misuse/abuse of rights, are corresponding remediation procedures established and implemented?
Detailed explanation
Records shall be kept of the creation/registration/granting/use/change/revocation of user accounts and access rights for information systems and personal information and important information.
- Records of user accounts and access rights shall include all necessary items so that accountability can be secured
- Account/access right application information : applicant or proxy applicant, application date and time, purpose of application, period of use, and so on
- Account/access right approval information : approver, whether approved or denied, reason and date/time, and so on
- Account/access right registration information : registrant, registration date, registration method (integration with an approval system, manual registration, and so on)
- Account/access right information : target system name, right name, details of the right, and so on
- Access right records shall be retained for at least a certain period, reflecting legal requirements and so on
- Personal information controllers under the Personal Information Protection Act : retain for at least 3 years
Criteria, review bodies, review methods, cycles, and so on for reviewing the adequacy of user accounts and access rights for information systems and personal information and important information shall be established, and periodic reviews shall be carried out.
-
Establish review procedures covering the review body, method, criteria, cycle (at least once per quarter recommended), result reporting, and so on for access rights review
※ Items for reviewing the adequacy of access right granting (examples)
- Whether access rights were granted following an official procedure
- Whether the access right classification scheme conforms to business purposes and security policy
- Adequacy of the access right approver
- Whether, upon a change of duties, existing rights were revoked and appropriate rights for the new duties were granted
- Whether excessive access rights beyond business purposes were granted
- Status and adequacy of the granting/change/issuance of special rights
- Status and adequacy of the issuance of accounts/rights to external parties such as partner companies
- Whether the access right application/approval records match the actual access right granting status
- Status of accounts of long-term non-connecting users and whether they are deleted (or locked)
- Whether accounts and rights are revoked without delay upon leave of absence or departure, and so on
Where the access rights review reveals problems such as excessive granting of access rights, non-compliance with the authorization procedure, or misuse/abuse of rights, corresponding remediation procedures shall be established and implemented.
- Where the access rights review reveals suspicious situations such as excessive granting of rights, non-compliance with procedures, or misuse/abuse of rights, establish and implement procedures that include requesting an explanation and analyzing the cause, preparing supplementary measures, a reporting system, and so on
- Notify users and relevant parties of rights that have been changed and applied following the access rights review
- Where similar problems recur, analyze the root cause and establish measures to prevent recurrence, and so on
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 5 (Management of Access Rights)
Evidence (examples)
- Access rights review criteria and procedures
- Access rights review history
- Access rights review result report and follow-up action records
Nonconformity examples
- A case where the method, inspection cycle, reporting system, misuse/abuse criteria, and so on related to access rights review are not specifically defined in the relevant guidelines, so that the access rights review is not carried out periodically
- A case where internal policies, guidelines, and so on require locking (deactivation) or deletion of accounts of long-term non-using users, but the account of a user who has not connected for 6 months or longer is active (the account was not identified because the access rights review was not carried out faithfully)
- A case where, during the access rights review, suspected cases of excessive granting and misuse/abuse of access rights were found, but follow-up actions such as detailed investigation and internal reporting were not carried out