Access Control Policy and Procedures
Medium Priority
Intermediate Level
NIST CSF
The organization develops, documents, and disseminates access control policy and procedures that address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance.
Implementation Guidance
Develop comprehensive access control policies that define who can access what resources, under what conditions, and for what purposes. Include procedures for granting, modifying, and revoking access rights.
Best Practices
Implement role-based access control (RBAC), conduct regular access reviews, maintain detailed access logs, use principle of least privilege
Testing Procedures
Review access control policies, test access provisioning and deprovisioning procedures, verify access logs are maintained
Related Guidelines
AC-2, AC-3, AC-4, AC-5, AC-6