NIST CSF 2.0, ProtectPR.AA-05

If you hold the list of sensitive zones, pass it only to people who need to know it and have access to it for their functions or mission in deploying and operating the 5G network (Article 105, paragraph 7).

Update access rights where changes are necessary and at least once a year for all ICT systems other than those supporting critical or important functions, and at least every 6 months for ICT systems supporting critical or important functions (Article 21).

Continuously monitor and control the security and functioning of your ICT systems and deploy ICT security policies, procedures, protocols and tools that keep data available, authentic, intact and confidential at rest, in use and in transit. Document an information security policy, policies that limit physical and logical access to what is needed, strong authentication mechanisms and protection of cryptographic keys, ICT change management, and policies for patches and updates, and design network connections so that they can be instantaneously severed or segmented (Article 9).

The Department says you should consider authentication factors that can withstand AI-manipulated deepfakes, avoiding authentication by SMS text, voice or video and using forms such as digital-based certificates and physical security keys; it states that as of November 2025 the regulation requires multi-factor authentication for all authorized users attempting to access your information systems or nonpublic information, and that your access controls must limit each authorized user's privileges to those necessary for the user's job functions.

The Department says you should consider restricting multi-factor authentication enrollment and changes to authorized processes with strong identity verification, employing phishing-resistant multi-factor authentication methods such as authenticator applications with number matching or hardware tokens, and conducting privileged access reviews, especially for threat-relevant users, systems and devices.

Based on your risk assessment, limit user access privileges on information systems that provide access to nonpublic information to only those necessary to perform the user's job, limit the number of privileged accounts and their access functions to only those necessary to perform the user's job, and use a privileged account only when performing functions that require that access.

Review all user access privileges periodically and at least annually, and remove or disable accounts and access that are no longer necessary; promptly terminate access following departures.

Implement technical and organizational measures against unauthorized or unlawful processing and against accidental loss, destruction or alteration, confine internal access to what each role requires, and train staff on their data protection duties.

Store or process personal data with technical and organizational security measures that protect against unauthorized or unlawful processing and against unintentional loss, destruction, or damage, and limit access to staff who need it for their duties.

Choose a sub-processor offering sufficient guarantees, bind them by a written contract limited to your instructions, and keep processing confidential and restricted to authorized staff.

For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.

Where the duty is triggered, maintain administrative, technical and organizational measures that: prevent unauthorized access to information and its transfer to a person without a right of access; detect an unauthorized access event in a timely manner; prevent adverse consequences from a breach of the access procedure; prevent disruption of the technical means used to process the information; permit immediate restoration of information altered or destroyed by unauthorized access; and continuously monitor the level of the information's protection.

Permit an agent to collect, use, disclose, retain or dispose of personal health information only where you are permitted to do so, it is necessary in the course of the agent's duties and the prescribed requirements are met, and take reasonable steps to ensure the agent acts only within that permission. You remain responsible for what your agents do.

When processing sensitive personal data, build the capacity of staff involved, control who can access it, and apply technical and organisational measures appropriate to the risk, including storing it separately and applying tokenisation, pseudonymisation or encryption where appropriate.

Allow access only to authorised persons, and record accesses and processing operations automatically in non-modifiable log files kept for five years (art. 10, comma 8).

Protect the smart contract through rigorous access control mechanisms at the governance and smart contract layers, and keep it consistent with the terms of the data sharing agreement that it executes (Article 36(1), points (d) and (e)).