7.2.2 Access is assigned to users, including privileged users, based on: • Job classification and function. • Least privileges necessary to perform job responsibilities
Access is assigned to users, including privileged users, based on: • Job classification and function. • Least privileges necessary to perform job responsibilities.
5
artefacts
2
held by a system
0
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- User access settings extracted from system components, including for privileged users · Identity provider / directory
- Records showing access reduced when a user changed role · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Policies and procedures covering assignment of access to users based on job classification and function · Policy repository / GRC workspace
- Comparison of assigned access against the job classification for a sample of users, showing least privilege applied · Policy repository / GRC workspace
- Management confirmation that the access held by their staff is what the role requires · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Access cloned from an existing user at onboarding, which propagates accumulated privilege
- Privileged users assigned broad administrative rights because scoping them is harder than granting them
- Role changes add new access without removing the old, so entitlement only ever grows
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.2.1 An access control model is defined and includes granting access as follows: • Appropriate access depending on the entity's business and access needs. • Access to system components and data resources that is based · 7.2.3 Required privileges are approved by authorized personnel