CC6.3 Role-based access and least privilege are enforced
Authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of lea.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of authorisation for access changes during the period, including modifications on role change · Identity provider / directory
- Evidence prior access was removed on role change, not merely supplemented · Identity provider / directory
- Access review evidence per system, showing the reviewer, the population reviewed and the revocations made and completed · Identity provider / directory
- Evidence least privilege and segregation of duties were considered in the role design, with the conflict analysis · Identity provider / directory
governing documentDocuments that govern the control
- Role definitions showing the access attached to each role, and the basis in job responsibility · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Access accumulation across role changes, which is the most frequently observed failure of this criterion
- Reviews certified in bulk with no revocations, indicating the review was not performed with real scrutiny
- Revocations identified in a review and never actioned, with no tracking to closure
- Roles defined so broadly that least privilege cannot be demonstrated for any individual
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC6.2 Prior to granting access, registration and authorization processes are established · CC6.4 Restricts physical access to facilities and protected information assets (for example, data center facilities, back-up media storage, and other sensitive locations) to authorized personnel to meet the entity's objectives