FFIEC IT Examination Handbook AIO-VI.A.3: VI.A.3 Identity and Access Management (Architecture, Infrastructure, and Operations)

Management implements identity and access management across people, processes and technology to authenticate users and grant or deny access to data and system resources, considers enhanced authentication especially for privileged access, addresses the access control requirements of cloud environments, and maintains a policy with standards and procedures that identify users and restrict physical, logical, cloud and privileged access by job function and operational need.