Crossfoot
Crossfoot / Controls / Least privilege and privileged access
Draft v0.1.06 of 6 frameworks

Least privilege and privileged access

Access is limited to what the role requires; administrative and privileged access is restricted and controlled.

Where it appears

SOC 2
CC6.3Role-based access and least privilege
PCI DSS 4.0
7.2.1An access control model is defined
7.2.2Access assigned based on job classification and least privileges
NIST CSF 2.0
PR.AA-05Access permissions managed incorporating least privilege
ISO 27001:2022
A.8.2Privileged access rights
A.8.3Information access restriction
HIPAA Security Rule
164.312(a)(1)Access control
164.308(a)(4)Information access management
NIST 800-53 r5
AC-6Least privilege
AC-5Separation of duties

Evidence auditors usually ask for

A typical starting list. Your assessor's request list is the one that counts.

  • Role/entitlement matrix showing job-based access assignments
  • List of privileged and administrator accounts with business justification
  • Evidence of privileged-access approval and review
  • Configuration screenshots showing RBAC or default-deny settings

Crosswalks that include this

SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to HIPAA Security RuleSOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to HIPAA Security RulePCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0