Access permissions are defined in policy, enforced, and reviewed using least privilege and separation of duties
Over-permissioned accounts are a root cause of breaches going far beyond the initial point of entry. Least privilege limits what any single compromised account can access. Separation of duties prevents any one person from both initiating and approving sensitive actions, reducing insider risk and accidental misconfiguration.
Implementation steps
- 1
Define a role-based access control model
Map your business roles to permission sets. Each role should grant the minimum access needed for that job function. Document the roles, what they can access, and who approves membership in each role.
oktamicrosoft-entraaws-iamgoogle-cloud-iam - 2
Remove or restrict standing privileged access
Administrators should not have elevated permissions at all times. Use just-in-time (JIT) access elevation that grants admin rights only when needed and revokes them automatically. Require approval for sensitive access requests.
cyberarkaws-iam-identity-centermicrosoft-pimteleport - 3
Enforce separation of duties for critical workflows
Identify workflows where a single person could cause significant harm if acting alone: deploying to production, approving payments, modifying audit logs. Require a second approver for each of these actions.
- 4
Conduct quarterly access reviews
Every 90 days, have each manager review the access held by their direct reports. Flag and revoke access that is no longer appropriate. Document the review with a sign-off.
sailpointsaviyntokta
Evidence required
RBAC role definitions
Documentation of defined roles, associated permissions, and who approves role assignments.
- · IAM role policy documents from AWS or GCP
- · IdP group definitions with linked application permissions
- · Spreadsheet or wiki mapping roles to system access
JIT or privileged access configuration
Evidence that standing privileged access is limited and JIT elevation is in use.
- · Microsoft Entra PIM activation policy screenshot
- · AWS IAM Identity Center permission set assignment logs
- · Teleport access request workflow configuration
Completed access review
Documentation of a completed access review from the last 90 days.
- · Signed-off access review spreadsheet with reviewer and date
- · Ticket showing access review task completed with list of revocations
- · SailPoint or Saviynt access review campaign results
Related controls
Identities and credentials are managed for authorized users and devices
Identity Management, Authentication, and Access Control
Identities are proofed and bound to credentials based on the context of interactions
Identity Management, Authentication, and Access Control
Users, services, and hardware are authenticated
Identity Management, Authentication, and Access Control
Identity assertions are protected, conveyed, and verified
Identity Management, Authentication, and Access Control