IAM-29—Least Privilege

>Control Description

Role-based access is defined and deployed to restrict privileged access to information resources based on the concept of least privilege.

Theme

Process

Type

Preventive

Policy/Standard

Access Management Procedure

>Implementation Guidance

1. Design and document the process for assigning least privilege access. 2. Ensure access is granted as per required approvals.

>Testing Procedure

1. Inspect logical access policy and validate that each role is assigned the correct level of access. 2. Inspect the logical access systems and review how the access levels are granted for types of roles (Developers, SWE, SRE). 3. For a sample of employees, inspect the level of access available and correlate to the job role and confirm that they are congruent.