7.3.2 The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function
The access control system(s) is configured to enforce permissions assigned to individuals, applications, and systems based on job classification and function.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration showing individual rights are inherited from group membership rather than granted directly · Identity provider / directory
periodic reviewEvidence produced at each review
- Evidence permissions apply to individuals, applications and systems, covering non-human identities · Identity provider / directory
governing documentDocuments that govern the control
- Vendor documentation and system settings for the access control system showing enforcement of permissions by job classification and function · Policy repository / GRC workspace
- Sample extracts of effective permissions demonstrating what the system actually enforces · Policy repository / GRC workspace
- Reconciliation between the enforced permissions and the documented access control model · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Direct individual grants layered on top of group membership, so effective access differs from the model
- Application and system accounts assigned permissions outside the access control system
- Enforcement verified from the configuration screen rather than from effective permission output
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.3.1 An access control system(s) is in place that restricts access based on a user's need to know and covers all system components · 7.3.3 The access control system(s) is set to “deny all” by default