HKMA Cyber Resilience Assessment Framework (C-RAF) 3.1.B: 3.1 Access control: baseline level

Baseline control principles for access control (required of every AI (minimum for a low inherent risk)). Identification and authentication govern access to systems, applications and hardware; password controls cover complexity, attempt limits and reuse, and passwords are encrypted in storage and transit; physical and logical access is removed immediately on any departure; access changes, including leavers, are approved by appropriate personnel; user access reviews run periodically by risk; default passwords and unnecessary default accounts are changed before implementation and regularly; production and non-production accounts are segregated; access is granted on job need, least privilege and separation of duties; elevated privileges are few, individual, unshared and more strongly protected, with separate administrative accounts or on-demand elevation; customer internet access uses authentication commensurate with risk (layered or multifactor) and call centres authenticate customers by transaction risk; physical controls protect IT and telecommunications equipment, with access to high-risk systems restricted, logged and blocked when unauthorised; remote access to critical systems by staff, contractors and third parties uses encryption and multifactor authentication; cryptographic keys are protected from unauthorised access. In 2.0 wireless and mobile access carry usage restrictions, configuration and connection requirements, and a key management policy covers generation, distribution, installation, renewal, revocation and expiry.