iac-21-leastprivilege.md

SCF - IAC-21 - Least Privilege

Mechanisms exist to utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions.

Mapped framework controls

ISO 27002

• A.5.15
• A.5.18
• A.8.12
• A.8.3

NIST 800-53

• AC-6

SOC 2

• CC6.1

Control questions

Does the organization utilize the concept of least privilege, allowing only authorized access to processes necessary to accomplish assigned tasks in accordance with organizational business functions?