Access Control Requirements. Access to information and technology must be authorized only by * . • Access to information and technology must be on a need-to-know, job function basis. Users must only have the minimum access rights and privileges needed to perform a particular function or transaction. • Access rights specified by an individual User * . • At least annually, a review of User access rights to information and technology must be conducted by the Information Protection Group. Review of this information must be conducted by the business process owner with oversight by the IPG. • At least semi-annually, a review of User access to information and technology identified as High Risk in the Risk Assessment Process must be conducted by the Information Protection Group. • Access must be controlled to restricted information including: • Security commands, programs, utilities, and databases; • Program libraries; • Job or process execution statement files; • User authorization profiles; • Accountability tracking logs; and • Backup files containing any of the above. • * • Access to system documentation, e.g., application documentation, User manuals, etc., must be restricted on a need-to-know, job function basis. • The development, implementation, and maintenance of application software must be approved by the Business Owner, and must be in compliance with the MSB, as well as, the American Express Application Development Standard. • All purchased, commercial software must be approved by the Business Owner, and be licensed and implemented in such a way as to be in compliance with the MSB, as well as, any applicable American Express Global Technology Standards. • The Business Unit Manager must notify the Information Protection Group immediately upon transfer, change of job responsibilities, or leave of absence of a User (employee or third-party). • When the Information Protection Group is notified that a User has transferred, changed job responsibilities, or taken a leave of absence, the Information Protection Group must immediately take steps to ensure that the User’s access privileges are revoked if those privileges no longer apply. • The Business Unit Manager must immediately notify the Information Protection Group upon termination of a User, i.e., an employee or third party. When the Information Protection Group is notified of a user termination, the Information Protection Group must take immediate action to revoke the User’s access privileges. • Virus prevention technology, (e.g., viru...
Access Control Requirements. Access to information and technology must be authorized only by * . • Access to information and technology must be * . • Access rights specified by an individual User * . • At least * , a review of User access rights to information and technology must be conducted by the * . Review of this information must be conducted by the business process owner with oversight by the * . • At least * , a review of User access to * . • Access must be controlled to restricted information including: * * • Access to system documentation, * . • The development, implementation, and maintenance of application software must be * . • All purchased, commercial software must be * . • * . • When the * . • The Business Unit Manager must immediately notify the * • * .
Access Control Requirements
