Skip to main content

Elevated Access to Computers

Ensure MSP compliance

idemeum Privileged Access Management (PAM) helps MSPs ensure compliance with major cyber security frameworks.

Overview

To stay secure and to sell to customers who require cyber insurance and compliance, MSPs attempt to ensure cybersecurity compliance with documentation tools, password vaults, and secure access tools. These tools should absolutely be used by MSPs, but they do not address the core items in every cybersecurity framework - the proper management and security of individual admin accounts.

How idemeum helps?

idemeum Privileged Access Management platform designed specifically for MSPs helps address the following cybersecurity objectives.

NIST 800-171

Objective Description
3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems.)
3.1.2 Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
3.1.4 Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.
3.3.2 Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.

NIST 800-53

Objective Description
3.7 Access Enforcement Role-based Access Control; Enforce a role-based access control policy over defined subjects and objects and control access based upon [Assignment: organization-defined roles and users authorized to assume such roles].

NIST 800-66

Objective Description
5.3.1.3 Ensure that all system users have been assigned a unique identifier.

CIS Control

Objective Description
5.4 Restrict administrator privileges to dedicated administrator accounts.
5.6 Centralized account management.
6.1 Establish an access granting process.
6.2 Establish an access revoking process.
6.8 Define and maintain role based access control.
8.2 Collect audit logs.
8.5 Collect detailed audit logs.
8.10 Retain audit logs.

CMMC

Objective Description
AC.1.001 Authorized Access Control: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems.)

PCI

Objective Description
8.1.3 Immediately revoke access for terminated users.
8.2.4 Change user passwords at least every 90 days.
8.5 Do not use group, shared, or public IDs, passwords, or other authentication methods.
8.5.1 Additional requirement for service providers only: service providers with remote access to customer premises should use unique authentication information for each customer.
8.6 Authentication mechanisms must not be shared among multiple accounts and physical and/or logical controls must be in place to ensure only the intended account can use that mechanism to gain access.

HIPAA

Objective Description
164.312 (a)(2)(i) Unique user identifier.

Essential Eight Maturity Model

Objective Description
Level 2 Restrict Administrative Privileges; Privileged access events are logged.