Citation Audit

Citation: Formulate access policy to support the mission and business use cases ¶ 3 – One challenge that organizations may have when formulating policy is that their ZTA may consist of numerous components that each perform policy engine and policy administrator roles. As a result, access policy may not be centralized; rules may be distributed across numerous products, i.e., with some rules configured in an endpoint protection component; some configured in ICAM components; other rules configured in a network security component; and still other rules configured in a data security or other components. The lack of a single location where all policy rules can be centralized may make it challenging for an organization to maintain an organized, complete, consistent understanding of its access policy. To help organizations manage their access policies, they should explicitly keep track of not only what their access rules are, but where each of the rules is configured.

Control: CC ID 513 – Establish, implement, and maintain an access rights management plan.