Article 33 Access Control

1. access rights to information assets means a collection of information, either tangible or intangible, that is worth protecting;, ICT assets means a software or hardware asset in the network and information systems used by the financial entity;, and their supported functions, and to critical locations of operation of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;, are managed on a need-to-know, need-to-use and least privileges basis, including for remote and emergency access;

2. user accountability, which ensures that users can be identified for the actions performed in the ICT systems;

3. account management procedures to grant, change, or revoke access rights for user and generic accounts, including generic administrator accounts;

4. authentication methods that are commensurate to the classification referred to in Article 30(1) and to the overall risk means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; profile of ICT assets means a software or hardware asset in the network and information systems used by the financial entity;, and which are based on leading practices;

5. access rights are periodically reviewed and are withdrawn when no longer required.

For the purposes of point (c), the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; shall assign privileged, emergency, and administrator access on a need-to-use or an ad-hoc basis for all ICT systems, and shall be logged in accordance with Article 34, first paragraph, point (f).

For the purposes of point (d), financial entitiesas defined in Article 2, points (a) to (t) shall use strong authentication methods that are based on leading practices for remote access to the financial entitiesas defined in Article 2, points (a) to (t)’ network, for privileged access, and for access to ICT assets means a software or hardware asset in the network and information systems used by the financial entity; supporting critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; that are publicly available.