FFIEC IT Examination Handbook IS-II.C.15(b): II.C.15(b) Application Access (Information Security)

Sensitive and mission-critical applications carry access controls that restrict the functions available to users and other applications, understood by management for their functionality and vulnerabilities, with robust authentication matched to the application's criticality, group profiles rather than individual rights, periodic review and approval of assigned access, enforced responsibilities of programmers, security administrators and application owners, time-of-day or terminal limits for sensitive functions, and logging with alerts and monitoring for anomalies.