Requirements for Computer Systems in the GMP Environment
2.5 Access control and user administration
To ensure the security of computer systems in the GMP environment, these systems should be equipped with an access control system. In addition to physical access control, access control systems protect computer systems against unauthorized access Users are assembled into groups, which are then used to manage user permissions.. Individual users can be granted access authorization in various ways:
• Combination of a unique user ID and password
• Chip cards together with a password
• Evaluation of biometric features
In general, actions that can be executed on a computer system must be protected against unauthorized access. Various rights can be assigned to users depending on their duties. Access to the user administration should only be given to the system owner or to a very limited number of employees defined by the system owner. Furthermore, it is absolutely essential that unauthorized access to electronically recorded data is prevented.
The use of an automatic logout function is advisable and provides additional access protection. This does not, however, absolve the user from the general responsibility of logging off when exiting the system. The automatic logout time should be defined in the specification in agreement with the system owner.
Note
Only authorized persons should be allowed access to PCs or the computer system. This can be supported with appropriate mechanisms such as mechanical locking and through the use of hardware and software for remote access.
2.5.1 Requirements for user ID and password
User ID
The user ID for a system should have a minimum length defined by the customer and be unique within the system.
Password
When passwords are created, a minimum number of characters and of the expiry period of the password should be defined. A password should generally comprise a combination of characters with a minimum length and should also meet at least three of the criteria listed below.
• Use of uppercase letters
• Use of lowercase letters
• Use of numerals (0-9)
• Use of special characters
The configuration is decribed in chapter 4.4 “Setting up the user administration for
HMI devices”.
16
SIMATIC WinCC (TIA Portal) V13 – GMP Engineering Manual
A5E35095213-AA
