Principle: B2 Identity and access control

Overview

This outcome relates to your organisation having cyber security and information governance (IG) controls in place to ensure staff have appropriate access to information.

Individually identifying and authenticating

All instances of access to personal confidential data on IT systems should be attributable to specific individuals.

Staff members should access information, systems and networks using their own individual credentials. You should understand the roles and their associated authorisation levels to access each information asset, system or network.

To preserve the one-to-one relationship between users and accounts, staff members should be aware that they hold responsibility for ensuring they:

• never share their password with anyone else
• never allow anyone else to use their smartcard
• never leave their smartcard unattended
• always remove their smartcard from the reader when they have finished using it

These obligations are not only essential measures for data security, but also form part of the terms and conditions of access to NHS Spine applications.

There may be some scenarios where there is a clear operational justification for using shared credentials. For example, in emergency planning, you may decide that it is appropriate for your organisation to keep laptops with generic user accounts for emergency use. In this scenario, you would apply additional security measures to keep the credentials secure and carefully manage access to them.  

Temporary staff members

Where staff members are provided by an external temporary staffing agency, your organisation should have gained sufficient confidence that the agency's identity check and validation procedures are as robust as your own.

For temporary staff members called at short notice, there could be scenarios where it would be impractical to undergo the verification, authentication and authorisation activities prior to account provision, which you undertake for your permanent or longer-term temporary members of staff. 

In these scenarios, you should take a risk-based approach to granting access to systems, taking into account the role, their access to confidential patient information and their access to critical elements of your IT infrastructure. You should have appropriate technical and procedural controls in place to ensure that all activities can be traced back to specific individuals, and that where accounts are temporarily assigned, they can only be accessed by a single person within a determined time frame. 

Centrally managed credentials such as NHSmail identities should be considered to provide additional authentication for temporary staff members accessing your systems.

Limiting authorised users and systems

You should ensure that staff members are granted access to information proportionally, so that they have exactly the level of access they need to fulfil their roles.

Role based access controls are key to achieving these requirements, and ‘least privilege’ should be a guiding principle. If a user only needs to view records, for example, there is no need for them to have an elevated role such as ‘admin’ or ‘super user’. The ‘view-only user’ role will give them the level of access they require. 

Your procedures should also ensure that access is removed from users as soon as it is no longer required. For this, your access controls need to be appropriately joined up with your processes for joiners, movers and leavers.

For each information asset, system or network supporting your essential functions, you should know the way that identity and access management procedures have been applied to achieve the desired outcome.

Additional authentication mechanisms

It is a requirement of the NHS England multi-factor authentication (MFA) policy that strong (phishing resistant) MFA is used on digital systems throughout the health sector, with particular requirements on accounts that are remotely accessible or have privileged access to systems.  

See guidance on the NHS England multi-factor authentication policy for more information.

If you have applied any of the permitted exceptions defined in the MFA policy, you are required to provide details of these in a prescribed MFA exceptions register. The register can be downloaded directly from the DSPT interface in the mandatory policy requirement section of contributing outcome B2.a. 

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome.

Examples can be found in the guidance on how to audit each outcome. You are welcome to provide other types of evidence not included in the published guidance if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate. 

Interpreting indicators of good practice

National services

The following national services may help you meet the requirements of B2.a identity verification, authentication and authorisation: 

• Security services | Technical Remediation 

• Security services | Cyber assurance service (CAS) 
• NCSC services | Check your cyber security 

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B2 Identity and access control
National Cyber Security Centre | Introduction to identity and access management
Information Commissioner’s Office | Records management and security – access control

For this contributing outcome, there is no minimum expected level of achievement for ‘Standards met’. You are still required to assess your achievement level and provide a response, showing you have considered the implications of the contributing outcome for your organisation’s cyber security and information governance (IG) activities. The Data Security Protection Toolkit (DSPT) ‘Standards met’ expectation should be regarded as a minimum compliance level, not the end goal of your organisation’s cyber security and IG activities.

Overview

To achieve this outcome you need to understand the scope and security characteristics of devices connected to your network.

Corporately owned and managed devices

Your corporately owned and managed devices should be securely configured, making it possible for staff members to perform their roles while mitigating the risk of system compromise by attackers. See NCSC guidance on device security for more information.

You should ensure that the number of privately owned devices such as bring your own devices (BYOD) is kept to the minimum amount necessary to sustain your essential function(s). You should also ensure you actively manage data protection risks for the use of any privately owned devices connected to your network.

Third party devices

You should have a process in place to minimise the risks presented by third party devices connected to your network, including privately owned devices (Bring Your Own Devices). This may include: 

• conducting checks (such as scanning for malware) 
• restricting devices that can connect to your network, such as through network access control
• having contractual data protection and security obligations in place with third-party device providers 
• segmenting your network to isolate third party devices

You should be aware of the risks and be assured that adequate mitigations are in place before allowing third-party devices to connect to your network.

Privileged access

Privileged operations such as system administration should only be carried out from corporately owned and managed devices, with controls in place to separate those privileged operations from normal user activity. Examples of this type of control include:

• dedicated privileged access workstations, specifically configured and protected for privileged operations and not used for any other activity 
• browse down administration, such as using a highly trusted device to access a remote desktop environment for normal user activities this can include thin clients accessing multiple remote environments separated for privileged and normal user activities
• browse up administration, such as using an ordinary device to access a remote desktop environment for privileged operations this approach is not recommended (see NCSC guidance on the browse up anti-pattern) but you may decide the risk is tolerable for a period of time while you implement a better solution
• issuing users with separate privileged accounts that have no access to the internet, email, or other higher-risk resources used by normal user accounts

Wherever possible, the administration of a system should be performed from a device that is trusted to at least the same level as that system.

If you have third party suppliers carrying out privileged operations, you should seek assurance (or set requirements) on the devices and architectures used - see NCSC guidance on systems administration architectures for examples and further information.

Although the expected interpretation of 'privileged operations' is narrow and relates only to security-relevant functions, you are likely to have other users with access to perform business-critical functions or to effect wide-ranging changes (such as finance users approving large payments, or software developers committing changes to code repositories). You should consider whether it is appropriate to apply the same or similar controls to those users and devices, based on risk.

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome.

Examples can be found in the guidance on how to audit each outcome. You are welcome to provide other types of evidence not included in the published guidance if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate.

Interpreting indicators of good practice

National services

The following national services may help you meet the requirements of B2.b Device management. 

Security services | Cyber assurance service (CAS)

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B2 Identity and access control
National Cyber Security Centre | Introduction to identity and access management
National Cyber Security Centre | Security architecture
National Cyber Security Centre | Device security guidance
NHS England | Network segmentation architecture patterns for connected medical devices
NHS England | Bring your own device (BYOD) guidance
Information Commissioner’s Office | Bring your own device (BYOD)

Overview

This outcome relates to you ensuring that privileged users are authenticated, monitored and managed effectively.

Authentication

It is a requirement of the NHS England multi-factor authentication (MFA) policy that strong (phishing resistant) MFA is used on digital systems throughout the health sector, with particular requirements on accounts that are remotely accessible or have privileged access to systems.  

See guidance on the NHS England multi-factor authentication (MFA) policy for more information.

Privileged access

You should know who has privileged access to systems within your organisation. Due to these accounts having an elevated level of privileged access, it becomes more important to revoke access when they no longer need it.

Reviews of privileged user access should not only be triggered when individuals leave the organisation, but also when their role changes within the organisation.

Reviewing and validating privileged user activity

You should log privileged user actions so that they can be independently reviewed and audited. 

To monitor privileged user activity most effectively, you should also define rules that detect suspicious activity and trigger active reviews of events. These rules could highlight when certain commands are run by administrators, or when changes are made at odd times, or in an unusual quantity. You should consider specific review practices for privilege operations carried out by external contractors and third parties such as suppliers.

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome.

Examples can be found in the guidance on how to audit each outcome. You are welcome to provide other types of evidence not included in the published guidance if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate.

Interpreting indicators of good practice

National services

The following national services may help you meet the requirements of B2.c Privileged user management:

• Security services | Cyber assurance service (CAS) 

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B2 Identity and access control
National Cyber Security Centre | Introduction to identity and access management

Overview

To achieve this outcome, your organisation needs to demonstrate that you closely manage and maintain identity and access controls for your information, systems and networks. 

Logging and monitoring user, device and system access

You should have logs showing when users have accessed your systems, and a process for reviewing the logs at appropriate intervals.

To obtain the best active view of users, devices and systems accessing systems supporting your essential function(s), the monitoring process can be automated from a central security information and event management (SIEM) tool. However, you will still need to have manual reviews of access logs in place for systems that cannot be integrated into a SIEM tool.

Access issues

The people who know best what information and systems they need to access to perform their role are your staff members. Staff should understand their responsibilities, including their obligation to access and use information responsibly, in line with the Caldicott Principles.

Your organisation should have clear channels for staff to report concerns about inappropriate access to information, whether they have too little access to perform their duties effectively or more access than is necessary for their role. For example, a member of the clinical team may be unable to view records needed to provide care, or a staff member may discover they can see departmental information which they have no legitimate need to access.

There should be a defined process for assessing, prioritising and resolving access issues, with target timeframes for resolution based on risk and operational impact. Where changes to access permissions are required, these should be implemented without undue delay following appropriate checks and authorisation.

Supporting evidence

To support your response, you can upload (or link to) evidence which best demonstrates your achievement of the contributing outcome.

Examples can be found in the guidance on how to audit each outcome. You are welcome to provide other types of evidence not included in the published guidance if you feel they are relevant to the contributing outcome.

Your supporting statement should cross-reference how each piece of evidence provides justification for your achievement of the contributing outcome, including relevant page numbers where appropriate.

Interpreting indicators of good practice

National services

The following national services may help you to meet the requirements of B2.d Identity and Access Management (IAM):

• Security services | Cyber assurance service (CAS) 

• Security services | Microsoft Defender for Endpoint (MDE) 

Additional guidance

For additional guidance, see:

National Cyber Security Centre CAF guidance | B2 Identity and access control
National Cyber Security Centre | Introduction to identity and access management
Information Commissioner’s Office | Records management and security – access control