EvidenceSheet

CM.L2-3.4.5 Access Restrictions for Change

Define, document, approve and enforce the physical and logical access restrictions that apply to making changes to systems.

3
artefacts
2
held by a system
0
at each review
easy
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • Access control configuration limiting who can implement changes · Identity provider / directory
  • Records showing enforcement, including physical restrictions where relevant · Physical access / facilities

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

  • Documented and approved change access restrictions · Policy repository / GRC workspace

First move

Automate the pull from your Identity provider / directory. Scheduled export of users, roles and MFA state from the directory; access-review completion pulled from the IdP, not a spreadsheet.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CM.L2-3.4.4 Security Impact Analysis · CM.L2-3.4.6 Least Functionality