Requirement
The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives.
Points of Focus
Creates or Modifies Access to Protected Information Assets
Requirement: Processes are in place to create or modify access to protected information assets based on authorization from the asset’s owner.
Removes Access to Protected Information Assets
Requirement: Processes are in place to remove access to protected information assets when no longer required.
Uses Access Control Structures
Requirement: The entity uses access control structures, such as role-based access controls, to restrict access to protected information assets, limit privileges, and support segregation of incompatible functions.
Reviews Access Roles and Rules
Requirement: The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals (for example, employees, contractors, vendors, business partner personnel) and inappropriate system or service accounts. Access roles and rules are modified, as appropriate.
Explanation
Access rights should match what each person or system actually needs to do their job — nothing more. Auditors check that access is granted through defined roles, that conflicting duties are separated, and that rights are reviewed and adjusted when responsibilities change, so privileges never quietly accumulate.
