Authorization Control Sample Clauses

Authorization Control. Security must allow access to authorized users only – to only those resources, files, applications, and services that they are authorized to use. Security will be definable by an administrator both on an individual user basis and by class of user (teachers, students, parents, administrators, etc.). Identification of a user must be unique to each individual. Operating systems and the application software must have the ability to be restricted or locked down in an appropriate way that prevents inadvertent or deliberate changes in key settings and, thereby, reduces support requirements.

Authorization Control. Entco will grant access authorizations on a "need-to-know" and "need-to-do" basis (lowest possible rights). Examples include access authorizations for task-related authorization schemes, user profiles, and functional roles. An access authorization will be sought on the basis of the role scheme and approved by the relevant supervisor. Additional control instances will be integrated into the approval process. For technical access security, Entco will use recognized security systems such as RACF, Active Directory, etc. Existing user accounts will be checked periodically and deleted or changed in the event that a user's tasks change. The responsibility for user accounts must be clearly assigned; representations are defined allowed in the current policies.

Authorization Control. Measures that ensure that those authorized to use a data processing system can only access the data subject to their access authorization and that personal data cannot be read, copied, modified or removed without authorization during processing, use and after storage.

Authorization Control. Implement a mechanism for controlling the authorization of individuals, organizations, and roles to access applications, data, and software. Assure supervision of personnel performing technical systems maintenance activities by authorized, knowledgeable persons. Work to train Users, including technical maintenance personnel, in system security.

Authorization Control. The aim of access control is to ensure that only those authorized to use a data processing system can access exclusively the pD subject to their task-related access authorization and that pD cannot be read, copied, modified or removed without authorization during processing, use and after storage. The implementation of the following measures supports this requirement. ☒ All employees who handle pD are separately bound to secrecy (e.g. by contract, declaration of commitment) or by law. ☒ Implementing a sufficiently differentiated role and authorization model ☒ Use of user IDs. ☒ Identification and authentication of users. ☒ Automatic verification of authorizations. ☒ Logging of access to specific files. ☒ Use of encryption methods. ☒ Separation of test and production operations.

Authorization Control. Measures to ensure that those authorized to use a data processing system can only access the data subject to their access authorization and that personal data cannot be read, copied, modified, or removed without authorization during processing, use and after storage. Logging of application access, specifically when entering, editing and deleting data Use of authorization concepts Minimum number of administrators Management of user rights by administrators 1.4 SEPARATION CONTROL Measures that ensure that data collected for different purposes can be processed separately. This can be ensured, for example, by logical and physical separation of the data. Separation of production and test environments Multi-tenancy of relevant applications Control via authorization concept Defining database rights 1.5 PSEUDONYMIZATION (Art. 32 para. 1 lit. a GDPR; Art. 25 para. 1 GDPR) The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures. In the case of pseudonymization: separation of assignment data and preservation in separate and separate secured system (possibly Internal instruction to anonymize / pseudonymize personal data as far as possible in the event of disclosure or even after the expiry of the statutory deletion period

Authorization Control. Implement a mechanism for controlling the authorization of individuals, organizations, and roles to access applications, data, and software. Integrate with Ordering Activity's existing identity management solution where one exists to enable single sign-on and centralized identity management. Assure supervision of personnel performing technical systems maintenance activities by authorized, knowledgeable persons. Ensure that system users, including technical maintenance personnel are trained in system security.

Authorization Control. Unauthorized activities in IT systems outside of granted authorizations must be prevented. Demand-oriented design of the authorization concept and the access rights as well as their monitoring and logging: ● The client determines through user settings and rights management in the software who has access to which information. The Client establishes guidelines for the length, complexity and expiration of passwords. ● The aforementioned access controls secure access to the personal data collected as part of the services. ● Access is restricted to employees of the contractor with corresponding responsibilities through an authorization concept. The number of Supplier's employees with authorizations is reduced to the "bare minimum”.

Authorization Control. The Contractor will grant access authorizations on a "need-to-know" and "need-to- do" basis (lowest possible rights). Examples include access authorizations for task-related authorization schemes, user profiles, and functional roles. An access authorization will be sought on the basis of the role scheme and approved by the relevant supervisor. Additional control instances will be integrated into the approval process. For technical access security, the Contractor will use recognized security systems such as RACF, Active Directory, etc. Existing user accounts will be checked periodically and deleted or changed in the event that a user's tasks change. The responsibility for user accounts must be clearly assigned; representations are defined allowed in the current policies.