Least-Privilege & Role-Based Access Control
- System access is governed by access-management and least-privilege policies enforcing least privilege and role-based access control.
- Administrative privileges require documented justification with manager and security approval.
- Access rights are reviewed and recertified periodically, including annual access reviews for in-scope systems.
Framework Alignment: NIST CSF PR.AA; CIS Control 5, 6; CMMC Level 1 (AC); SOC 1 Type II; GDPR Art. 32; ISO 27001:2022 A.5.15, A.5.18, A.8.3
