Question ID

Domain

How is access to sensitive systems and data restricted based on roles or responsibilities?

0 - Non-Compliant
No access restrictions are in place.
1 - Initial
Access is partially restricted, but enforcement is inconsistent.
2 - Defined
Access is restricted based on job roles and documented in an access control policy.
3 - Managed
Role-based access controls (RBAC) with quarterly reviews and removal of unnecessary permissions.
4 - Optimized
RBAC integrated with identity governance systems; access permissions dynamically adjusted based on real-time context.
N/A
Not applicable.

Each question must be completed either by selecting one option or by entering text.