| 💼 a. undertake due diligence processes before granting access to personnel. The use of contractors and temporary staffing arrangements may elevate the risk for certain roles; | | | | |
| 💼 b. implementation of role-based access profiles which are designed to ensure effective segregation of duties; | | | | |
| 💼 c. prohibiting sharing of accounts and passwords (with the possible exception of generic accounts, where prohibiting sharing of accounts and passwords is unavoidable due to technology constraints); | | 1 | 1 | |
| 💼 d. changing default passwords and user names | | | | |
| 💼 e. timely removal of access rights whenever there is a change in role or responsibility and on cessation of employment; | | | | |
| 💼 f. session timeouts; | | | | |
| 💼 g. processes to notify appropriate personnel of user additions, deletions and role changes; | | | | |
| 💼 h. audit logging and monitoring of access to information assets by all users; | | 7 | 8 | |
| 💼 i. regular reviews of user access by information asset owners to ensure appropriate access is maintained; | | | | |
| 💼 j. multi-factor authentication for privileged access, remote access and other high-risk activities; | | 2 | 2 | |
| 💼 k. generation, in preference to storage, of passwords/Personal Identification Numbers (PINs) where used to authorise high-risk activities (e.g. debit/credit card and internet banking transactions); | | | | |
| 💼 l. two-person rule applied to information assets with the APRA-regulated entity’s highest level of sensitivity rating (e.g. encryption keys, PIN generation, debit/credit card databases). | | | | |