ENS authorisations log (org.4 process)

What the standard requires

---

What ENS demands and what it leaves to your judgement

Measure org.4 calls for a formal authorisation process covering, at least, the use of facilities, the entry of equipment and applications into production, the establishment of communications links with other systems, the use of information media, the use of mobile devices and the use of third-party services.

The Royal Decree requires the process; the log is what proves it is followed. An authorisation buried in a stray email cannot be audited two years later.

It is worth writing down who authorises each type of component and against which criteria: prior checks, security configuration, impact on the category.

Structure

---

Fields the template should include

• Number, request date and requester
• Type: facility, equipment, application, link, media, mobile device, third-party service
• Description and purpose
• Security checks carried out
• Impact on the category or on the statement of applicability
• Decision, authoriser and date
• Conditions imposed

At the audit

---

Mistakes auditors commonly flag

• Equipment or applications in production with no recorded authorisation.
• Cloud services contracted by a department without going through the process.
• Nothing in writing about who may authorise each type of component.
• Authorisations without the checks that justify the decision.

In Kimobox

---

How this record is kept in Kimobox

1. 1The component authorisation process is recorded as an approval workflow.
2. 2Each request goes to whoever must authorise it according to its type, and the decision is logged with date and author.
3. 3The documentation of an authorised service’s provider sits in the supplier portal, with its expiry dates monitored.

Frequently asked questions

---

What people ask us before getting started