PR.AA-03.203

Has your organization implemented a process to ensure emergency access to critical safety systems for authorized personnel?

Explanation

Emergency access readiness is under review here, covering whether you have a process that lets authorized personnel reach critical safety systems when normal access methods fail. For example, during a system outage, ransomware attack, or when primary administrators are unavailable, designated personnel should still be able to access systems necessary for safety operations.

Evidence could include documented emergency access procedures, a list of personnel authorized for emergency access, logs of emergency access testing exercises, or break-glass account management policies that detail how emergency credentials are secured, accessed, and audited after use.

Implementation Example

Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions

ID: PR.AA-03.203

Context

Function
PR: PROTECT
Category
PR.AA: Identity Management, Authentication, and Access Control
Sub-Category
Users, services, and hardware are authenticated

Related questions