Protect 2.3 Protect 2.3.1 Access management Ensure that physical and logical access to ICT assets and facilities is restricted to authorised individuals, processes and devices, and that they can be used only for permitted activities. Description Task PR.AC-1 Establish a clearly defined procedure for granting and managing permissions and access data for users, devices and processes. PR.AC-2 Ensure that only authorised individuals have physical access to ICT assets. Take action (on building security, for example) to ensure that ICT assets are protected from unauthorised physical access. PR.AC-3 Establish procedures by which to manage remote access. PR.AC-4 Define permission levels according to the principle of least privilege, as well as separation of functions. PR.AC-5 Ensure that the integrity of your network is protected. Segregate your network both logically and physically where necessary and sensible. PR.AC-6 Ensure that digital identities are allocated to unambiguously authenticated individuals or processes. Table 15: PR.AC tasks Standard Reference COBIT 5 DSS05.04, DSS06.03, DSS01.04, DSS05.05, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS06.03, BAI08.03 ISA 62443-3:2013 SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 1.13, SR 2.1, SR 2.6, SR 3.1, SR 3.8, SR 2.2, SR 2.3 ISO 27001:2013 A.9.2.1, A.9.2.2, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, A.11.1.1, A.11.1.2, A.11.1.4, A.11.1.6, A.11.2.3, A.6.1.2, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.2, A.9.2.3, A.9.2.5, A.9.2.6, A.9.4.1, A.9.4.4 NIST-SP-800-53 Rev. 4 AC-2, IA Family, PE-2, PE-3, PE-4, PE-5, PE-6, PE-9, AC‑17, AC-19, AC-20, AC-2, AC-3, AC-5, AC-6, AC-16, AC-24, IA-2, IA-4, IA-5, IA-8 BSI M 2.30, M 2.220, M 2.11, M 4.15, M 1.79, M 2.17, B 2.2, B 2.12, B 5.8, B 4.1, M 2.393, M 2.5, B 1.18, M 2.220, M 2.8, M 4.135, B 4.1, M 5.77, M 2.393, M 2.5, M 3.33, M 2.31, M 2.586, M 4.135 Table 16: PR.AC references Minimum ICT standard 2018 21