| Identity Management |
Processes for creating, verifying, maintaining, and removing user, administrator, service, and device identities. |
Creates a reliable identity foundation for employees, contractors, partners, and connected devices. |
Employee onboarding, department transfers, resignations, supplier access, and service-account management. |
Reduces orphaned accounts, duplicate identities, and unauthorized access. |
Use a documented identity lifecycle with approval, periodic review, suspension, and deletion procedures. |
Percentage of active accounts with an assigned owner; account deactivation time after termination. |
| Authentication |
Verification that a person, system, or device is the legitimate holder of an identity. |
Prevents unauthorized users from entering enterprise applications, networks, facilities, and data environments. |
Password authentication, certificates, one-time passwords, biometrics, and multi-factor authentication. |
Improves resistance to credential theft, phishing, and account takeover. |
Apply stronger authentication to administrators, remote access, sensitive systems, and high-value transactions. |
Multi-factor authentication coverage; failed-login rate; percentage of privileged accounts using phishing-resistant methods. |
| Authorization |
Rules that determine which resources an authenticated identity may access and which actions it may perform. |
Limits employees and systems to the data and functions required for their responsibilities. |
Role-based access, attribute-based access, application permissions, database privileges, and API authorization. |
Supports least privilege and reduces the impact of compromised accounts. |
Access rights should be based on job responsibility, business need, resource sensitivity, and operating context. |
Number of excessive privileges identified; percentage of access rights reviewed on schedule. |
| Role-Based Access Control |
A model in which permissions are assigned to job roles rather than directly to individual users whenever practical. |
Helps large enterprises standardize access across branches, departments, projects, and subsidiaries. |
Finance approval roles, human-resource roles, production-operation roles, and system-administration roles. |
Simplifies administration and improves consistency during personnel changes. |
Separate incompatible duties, such as request, approval, payment, and audit functions. |
Percentage of users assigned through approved roles; number of conflicting-role exceptions. |
| Privileged Access Management |
Controls and monitors accounts that can change configurations, access sensitive data, or manage security controls. |
Protects high-impact administrator accounts used in data centers, cloud platforms, databases, and operational systems. |
Time-limited elevation, approval workflows, credential vaulting, session recording, and emergency access. |
Limits administrative misuse and improves investigation of high-risk activities. |
Use separate administrator identities, approval-based elevation, strong authentication, and detailed activity logging. |
Percentage of privileged sessions recorded; average time to remove unnecessary elevated rights. |
| Physical Access Control |
Measures that restrict entry to buildings, rooms, equipment areas, and other physical locations. |
Protects servers, network equipment, production lines, laboratories, archives, and restricted offices. |
Access cards, biometric verification, visitor registration, turnstiles, guards, and surveillance integration. |
Reduces unauthorized entry, theft, tampering, and physical damage to information assets. |
Maintain visitor records, access permissions, alarm procedures, and access logs for restricted areas. |
Unauthorized-entry attempts; visitor-log completeness; average response time to access alarms. |
| Network Access Control |
Controls whether users and devices may connect to wired, wireless, remote, or segmented enterprise networks. |
Separates office, production, guest, supplier, and sensitive network environments. |
Device posture checks, network segmentation, remote-access gateways, and access policies based on identity and location. |
Restricts lateral movement after a device or account is compromised. |
Classify networks by risk and limit connectivity between information-technology and operational-technology environments. |
Percentage of managed devices meeting security requirements; number of unauthorized network connections blocked. |
| Data Access Control |
Rules governing access to data according to sensitivity, ownership, purpose, location, and permitted operations. |
Protects personal information, important data, trade secrets, financial records, and operational data. |
Database permissions, document access, data masking, field-level controls, download restrictions, and data-loss monitoring. |
Reduces unauthorized disclosure, excessive internal access, and improper data use. |
Apply data classification, purpose limitation, minimum necessary access, and traceable approval procedures. |
Percentage of sensitive datasets with defined owners; unauthorized download events; access-review completion rate. |
| Application and API Access |
Controls access to enterprise applications, microservices, interfaces, and automated business transactions. |
Protects digital platforms and prevents unauthorized calls between internal and external systems. |
Single sign-on, token-based authorization, API scopes, service identities, and transaction-level permissions. |
Reduces abuse of exposed interfaces and limits application-to-application privileges. |
Use short-lived credentials, explicit scopes, rate limits, input validation, and separate service accounts. |
Percentage of APIs with authenticated requests; expired-token rate; blocked unauthorized API calls. |
| Zero-Trust Access |
An approach that continuously evaluates identity, device, application, resource, and context instead of automatically trusting network location. |
Supports secure access for branch offices, remote workers, cloud workloads, suppliers, and mobile users. |
Continuous verification, micro-segmentation, adaptive policies, device compliance checks, and session risk evaluation. |
Reduces reliance on perimeter security and limits unauthorized movement across environments. |
Verify explicitly, use least privilege, and continuously assess access conditions throughout a session. |
Percentage of remote sessions subject to continuous evaluation; number of high-risk sessions automatically restricted. |
| Audit Logging and Accountability |
Recording access requests, approvals, authentication events, permission changes, and user activities. |
Provides evidence for security investigations, internal control, compliance reviews, and incident response. |
Centralized logs, administrator activity records, access reports, alert correlation, and tamper-resistant storage. |
Improves traceability and shortens the time required to identify abnormal access. |
Synchronize system time, protect log integrity, restrict log access, and define retention periods based on risk and requirements. |
Log coverage for critical systems; alert investigation time; percentage of logs successfully delivered to centralized storage. |
| Periodic Access Review |
A formal review that confirms whether existing permissions remain appropriate and necessary. |
Prevents access accumulation caused by transfers, temporary projects, promotions, and organizational changes. |
Quarterly reviews for sensitive systems, event-driven reviews after role changes, and annual reviews for standard systems. |
Detects excessive, unused, conflicting, or expired permissions. |
Require resource owners and line managers to approve, modify, or revoke access based on documented evidence. |
Review completion rate; average remediation time; percentage of dormant permissions removed. |
| Compliance and Governance |
Policies, responsibilities, controls, and evidence used to manage access risks and satisfy applicable obligations. |
Aligns access-control practices with enterprise risk management and China’s cybersecurity, data, and personal-information governance requirements. |
Security policies, classified-protection assessments, privacy impact reviews, supplier assessments, and audit evidence. |
Improves regulatory readiness and establishes consistent accountability across business units. |
Common reference areas include the Cybersecurity Law, Data Security Law, Personal Information Protection Law, and classified protection practices such as MLPS 2.0. |
Number of unresolved access-control findings; policy review frequency; percentage of critical systems with assigned control owners. |
| Supplier and Third-Party Access |
Controls access granted to contractors, service providers, delivery partners, and other external organizations. |
Allows necessary collaboration while limiting risks introduced through external accounts and remote maintenance. |
Named accounts, contract-based permissions, approval workflows, time-limited access, monitored sessions, and automatic expiry. |
Reduces third-party exposure and improves accountability for outsourced operations. |
Grant only task-specific access, prohibit shared accounts where possible, and revoke access when work is completed or contracts end. |
Percentage of third-party accounts with expiry dates; vendor access review completion rate; number of shared external accounts. |
| Business Continuity and Emergency Access |
Procedures that maintain essential operations while controlling access during outages, disasters, or urgent incidents. |
Balances availability and security when normal identity services or approval channels are unavailable. |
Break-glass accounts, offline procedures, backup authentication, emergency approvals, and post-event reviews. |
Maintains critical services without creating permanent uncontrolled privileges. |
Keep emergency credentials protected, restrict their use, alert on activation, and review every emergency session afterward. |
Emergency-account activation count; time to restore critical access; percentage of emergency events reviewed. |
