FFIEC IT Examination Handbook IS-II.C.15(a): II.C.15(a) Operating System Access (Information Security)

What does IS-II.C.15(a) require?

System and security administrators restrict and monitor privileged access to operating systems and system utilities: user access restricted at program, file, record or field level as sensitivity requires, the number of employees with operating system access limited to the minimum, access to and activity on system parameters, data-altering utilities and sensitive resources restricted and logged with supplementary security software, operating system access confined to specific terminals in physically secure monitored locations, external drives and portable media secured or removed outside secure locations, remote access to the operating system prohibited where feasible and otherwise strongly authenticated and encrypted, with the further measures the booklet lists.