Has your organization implemented a process to ensure emergency access to critical safety systems for authorized personnel?
Explanation
Emergency access readiness is under review here, covering whether you have a process that lets authorized personnel reach critical safety systems when normal access methods fail. For example, during a system outage, ransomware attack, or when primary administrators are unavailable, designated personnel should still be able to access systems necessary for safety operations.
Evidence could include documented emergency access procedures, a list of personnel authorized for emergency access, logs of emergency access testing exercises, or break-glass account management policies that detail how emergency credentials are secured, accessed, and audited after use.
Implementation Example
Ensure that authorized personnel can access accounts essential for protecting safety under emergency conditions
ID: PR.AA-03.203
Context
- Function
- PR: PROTECT
- Category
- PR.AA: Identity Management, Authentication, and Access Control
- Sub-Category
- Users, services, and hardware are authenticated
Related questions
- Does your organization have a formal process to request, track, review, and fulfill access requests that includes appropriate approval from system or data owners?
- Does your organization have a formal process for managing the lifecycle of cryptographic certificates, keys, identity tokens, and other credentials?
- Does your organization use unique device identifiers based on immutable hardware characteristics or secure provisioning methods?
- Does your organization physically label all authorized hardware assets with unique identifiers for inventory tracking and servicing purposes?
- Does your organization verify individuals' identities during enrollment using government-issued credentials?
- Does your organization issue unique credentials to each individual user and prohibit credential sharing?