Definitions
Business Owner
A designated organizational official who "owns" the purpose of the information system and is ultimately accountable for the business function performed by that system and for accepting the risks associated with its operation.
Critical System
Those systems with an impact rating of high or critical in their Business Impact Assessment (BIA), or that are otherwise designated and documented by their business owners as critical.
Sensitive Information
Any information that is internal, not for public consumption, or otherwise could result in harm to the organization.
Directive (AC-1: Access Control)
GNB must maintain a comprehensive and authoritative function for performing account and access management. This ensures that access to information systems is granted only to authorized individuals. Access aligns with business requirements and complies with all applicable legislation, executive directives, and governmental policies.
This directive includes additional Directive Controls to further define requirements for specific control areas. The controls must remain current, effective, auditable, and aligned with emerging cybersecurity risks and operational needs.
Purpose
The Government of New Brunswick (GNB) is committed to ensuring the confidentiality, integrity, and availability of its information assets through the establishment and consistent application of robust access control practices. The purpose of this directive is to establish standardized access control requirements for GNB information systems. These control requirements align with the NIST Access Control (AC) family of security controls for ease of reference.
These requirements ensure that access to information and system resources is only granted to authorized individuals, processes, and devices, based on the principles of least privilege and need-to-know. By implementing these controls, the directive aims to protect the confidentiality, integrity, and availability of GNB data, reduce the risk of unauthorized access, and maintain compliance and consistency with industry good practices, and applicable regulations.
Through this directive, GNB establishes a clear, unified, and accountable governance structure for access control. This protects government systems, upholds security principles, and supports the safe and effective delivery of public services.
