Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.01.05Least privilegeITSP.10.171Access control

Official Requirement

A. Allow only the authorized system access for users (or processes acting on behalf of users) that is necessary to accomplish assigned organizational tasks. B. Authorize access to [Assignment: organization-defined security functions] and [Assignment: organization-defined security-relevant information]. C. Review the privileges assigned to roles or classes of users [Assignment: organization-defined frequency] to validate the need for such privileges. D. Reassign or remove privileges, as necessary.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

Users and processes should only have the minimum access necessary to do their job. Access to security functions and security-sensitive data needs explicit authorization. Privileges must be reviewed periodically and adjusted or revoked when no longer needed.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Least privilege access management

Implementation steps

  1. Assign permissions based on Active Directory security groups aligned to specific job functions rather than individual user permissions
  2. Remove local administrator rights from standard user workstations and use a PAM solution for elevated tasks
  3. Audit file share and application permissions quarterly to identify and remove excessive access
  4. Implement a formal process for requesting and approving additional privileges with documented business justification

Tools / systems

Evidence artifacts

Evidence frequency: Quarterly permission audits; per-event access request documentation