OpenLegislation

Article 13 Access control

United Kingdom

Original text. Later amendments are not shown.

1.

The Security Policy shall establish a formal staff registration and de-registration procedure in place for granting and revoking access to VIS hardware and software at the central VIS for the purposes of the operational management. The allocation and use of adequate access credentials (passwords or other appropriate means) shall be controlled through a formal management process as laid down in the Security Policy.

2.

Access to VIS hardware and software at the central VIS shall:

  1. (i)

    be restricted to authorised persons;

  2. (ii)

    be limited to cases where a legitimate purpose in accordance with Articles 42 and 50(2) of Regulation (EC) No 767/2008 can be identified;

  3. (iii)

    not exceed the duration and scope necessary for the purpose of the access; and

  4. (iv)

    take place only in accordance with an access control policy to be defined in the Security Policy.

3.

Only the consoles and software authorised by the Local Security Officer for central VIS shall be used at the central VIS. The use of system utilities that might be capable of overriding system and application controls shall be restricted and controlled. There shall be procedures in place to control the installation of software.