It is expected by the SOC 2 access criteria, ISO 27001 Annex A and most security frameworks. In practice it means role-based access, periodic access reviews, prompt removal of access that is no longer needed and narrow scopes for API and agent credentials.
Read more
Related terms
- Segregation of duties
- Segregation of duties is the principle that no one person can carry out and conceal a sensitive action alone, such as making and deploying a change.
- Control
- A control is a measure an organization puts in place to manage a risk or meet a requirement, such as an access review, an approval step or encryption.