SIG (Shared Assessments) H: Control logical access across endpoints with authentication, least privilege and privileged access management

SIG risk domain H, Access Control. The third party's access control program ensures that only authorised users, services and devices are authenticated and reach data and systems, applying authentication strength, least privilege, segregation of duties, role-based access, privileged access management and remote access controls, with identity assertions protected and verified before access is granted and access reviewed periodically.