Kibernetinio saugumo reikalavimų aprašas (KSRA)
Access Management and Multi-Factor Authentication Measures
65. The head of the cybersecurity entity or a person authorised by them must establish an access management procedure covering:
- 65.1. the formation of groups of the cybersecurity entity's users, administrators and service providers, and the granting and management of rights and access to the entity's network and information systems
- 65.2. the levels of administrator access to the network and information system and the cybersecurity requirements applied at those levels (reading, creating, updating and deleting data, editing network and information system user information and access rights, and the like)
- 65.3. requirements for registering and deregistering users of the network and information systems, and the appointment of a person responsible for carrying out those actions
- 65.4. the means for establishing the identity of users of the network and information systems
- 65.5. requirements for the composition, validity period and changing of passwords of network and information system users and administrators:
- 65.5.1. the requirement that personal information (for example, date of birth, names of family members and the like) must not be used to compose passwords
- 65.5.2. the requirement that a password may not consist of repeated or sequential characters (e.g. “aaaaaaaaaaaa” or “0123456789”) or a common keyboard sequence (e.g. “Qwerty”)
- 65.5.3. the prohibition on using manufacturer-set passwords in hardware and software; they must be changed in accordance with the requirements laid down in this chapter
- 65.6. the prohibition on disclosing passwords to other persons
- 65.7. the conditions and cases in which the right of network and information system users and administrators to work with specific information is revoked
- 65.8. the permitted methods of remote connection by users and administrators to the network and information system
- 65.9. the methods of using multi-factor authentication measures.
66. The cybersecurity entity must approve a list of the persons granted administrator rights to connect to the network and information systems, which must be reviewed periodically by the person responsible for cybersecurity. The list must be reviewed when an administrator is suspended or their employment (service) relationship ends.
67. Passwords may not be stored or transmitted in plain text. Only a temporary password may be transmitted in plain text, but separately from the login name, if the user is unable to decrypt an encrypted password received or there is no technical possibility of transmitting the password to the user over an encrypted channel or a secure electronic communications network.
68. The head of the cybersecurity entity or a person authorised by them must approve provisions on the use within the entity of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications, and secure emergency communications systems.
69. The technical requirements applicable to cybersecurity entities are set out in Table 7.
All cybersecurity entities
58. Administrator functions must be performed using a separate dedicated account, which may not be used to perform everyday user functions.
59. Users may not be granted administrator rights.
60. Every user must be uniquely identifiable.
61. Users and administrators must confirm their identity with a password and an additional authentication measure (multi-factor authentication measures).
62. A user's right to work with a specific network and information system must be suspended when the user has not used that system for more than 3 months.
63. An administrator's right to work with the network and information system must be suspended when the administrator has not used that system for more than 2 months.
64. Where a user or administrator is suspended from work (duties), does not meet the qualification requirements laid down for users or administrators in other legal acts, or their employment (service) relationship ends or they cease to be trustworthy, their right to use the network and information system must be revoked immediately, and no later than within the period established by the cybersecurity entity.
65. Unnecessary or unused network and information systems accounts must be blocked immediately, and no later than within the period established by the cybersecurity entity, and deleted once the log retention period (at least 90 calendar days) has elapsed.
66. On finishing work or leaving the workstation, users must log off from the network and information systems and activate a password-protected screen saver.
67. Where no actions are performed in the networks and information systems, the workstation must lock (after no more than 15 minutes) so that the network and information system can be used further only after the identity has been confirmed again.
68. The parts of the network and information system, including websites and browsers, that confirm the user's identity must prohibit the saving of passwords, except for specialised password management software.
69. A password must consist of upper-case and lower-case letters, digits and special characters.
70. A maximum permitted number of user attempts to connect to the network and information systems must be set — no more than 5 times in a row. After the specified number of attempts, the account for connecting to the network and information systems must be locked. Only authorised persons may unlock it.
71. Additional user password requirements:
- 71.1. the password must be changed at least every 6 months;
- 71.2. the password must consist of at least 10 characters;
- 71.3. a changed password must not be allowed to be composed of any of the previous 6 passwords;
- 71.4. on connecting to the network and information systems for the first time, the user must be required to change the password;
- 71.5. the user must be able to change the password at any time.
72. Additional administrator password requirements:
- 72.1. the password must be changed at least every 6 months;
- 72.2. the password must consist of at least 15 characters;
- 72.3. when changing the password, the use of any of the previous 8 passwords must not be allowed.
<...>
75. Local user and administrator accounts must meet the requirements laid down in this section.
76. Additional identification, authentication and usage control requirements (for the cybersecurity entity's websites accessible from public electronic communications networks):
- 76.1. it is prohibited to store in the program code any data (name, password, application programming interface keys / tokens, etc.) the disclosure of which could be used to gain access to devices, resources, accounts or controls.
Additionally, only for Essential cybersecurity entities
73. Administrator accounts must be controlled:
<...>
- 73.2. administrator account control measures are used that periodically check administrator accounts. Administrator accounts that do not meet the requirements laid down in this section must be reported to the authorised person.
74. User accounts are controlled:
<...>
- 74.2. user account control measures are used that periodically check user accounts. User accounts that do not meet the requirements laid down in this section must be reported to the authorised person.
Additionally, only for Important cybersecurity entities
73. Administrator accounts must be controlled:
- 73.1. it is checked regularly, at least once a year, whether administrator accounts meet the requirements laid down in this chapter, and administrator accounts that do not meet the requirements laid down in this section are reported to the authorised responsible person;
74. User accounts are controlled:
- 74.1. it is checked regularly whether user accounts meet the requirements laid down in this section. User accounts that do not meet the requirements laid down in this section must be reported to the authorised person;