[non-validated] Documented Authorization Boundaries for Privileged Actions (NIS2 Art. 21)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Have documented authorization boundaries defining who may perform security-critical privileged actions been formally approved by management bodies and maintained current per NIS2 Article 21 obligations?
Explanation
[non-validated] Do management bodies maintain formally approved documentation defining personnel authorized for security-critical privileged actions (e.g., system configuration, access control changes) per NIS2 requirements? Evidence must demonstrate current authorization boundaries; missing documentation results in pending status until submitted for verification against operational obligations.
Criterion and evidence
Verification against Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g) requirement to 'lay down roles and responsibilities' with management approval. Applies to security-critical privileged actions (system configuration, access control, incident response) across NIS2 sectors. Evidence period: current operational state per Article 21 obligations. Required evidence must explicitly define authorization boundaries without acceptable alternatives.
AI assistance prompt
Replace this placeholder with one clear yes/no condition within the scope of Roles, Responsibilities, Authorities, and Security Policy. Define the evidence rule and keep the question within 512 characters. Do not invent an assessment outcome.
Clarifications
What evidence verifies compliance?
Formally approved documentation showing role-based authorization matrices specifying personnel/groups permitted to execute privileged actions (e.g., 'Security Admin: Firewall modifications, user access revocation'). Must reference Implementing Regulation (EU) 2024/2690 Annex 1.1.1(g) requirement to 'lay down roles and responsibilities'.
How is missing evidence handled?
Authorization framework documentation must be submitted for assessment per evidence period requirements. Absent evidence results in 'pending' status; verification occurs upon receipt of documentation confirming current operational compliance.
References
ENISA Technical Implementation Guidance on Cybersecurity Risk Management Measures (Version 1.0)