Define and Maintain Role>Based Access Control
Description
Define and maintain role-based access control, through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized, on a recurring schedule at a minimum annually, or more frequently.
Implementation Checklist
Tool Recommendations
Identity governance and administration platform with access certification, lifecycle management, and AI-driven access intelligence
SailPoint · Per-identity subscription
Cloud identity and access management with SSO, MFA, conditional access, and identity governance
Microsoft · Per-user subscription (P1/P2)
Cloud identity platform providing SSO, adaptive MFA, lifecycle management, and API access management
Okta · Per-user subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Privilege Creep Leading to Unauthorized Data Access
ConfidentialityWithout defined role-based access, users accumulate permissions over time as they move between teams, eventually holding excessive access that violates least privilege principles.
Insider Threat Amplified by Undefined Access Boundaries
ConfidentialityA malicious insider exploits vaguely defined access rights to access data and systems far beyond their actual job requirements, since no RBAC model restricts them to necessary access.
Compliance Failure from Undocumented Access Rights
IntegrityRegulatory auditors find access rights are not documented by role, making it impossible to demonstrate least-privilege compliance with frameworks like SOX, HIPAA, or PCI DSS.
Vulnerabilities (When Safeguard Absent)
No Role-Based Access Control Model Defined
Without defined roles mapping job functions to required access rights, permissions are granted ad-hoc based on individual requests rather than standardized role requirements.
No Recurring Access Privilege Review Process
Without annual or more frequent access reviews validating privileges against role definitions, accumulated permissions are never identified or revoked.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Record | Access review/recertification records with sign-off | Quarterly |
| Technical | Access control configuration evidence (RBAC settings, group memberships) | Reviewed quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |