## Question ID

## Domain

## Question

How is access to sensitive systems and data restricted based on roles or responsibilities?

## Selected Option

- **0 - Non-Compliant**  
  No access restrictions are in place.
- **1 - Initial**  
  Access is partially restricted, but enforcement is inconsistent.
- **2 - Defined**  
  Access is restricted based on job roles and documented in an access control policy.
- **3 - Managed**  
  Role-based access controls (RBAC) with quarterly reviews and removal of unnecessary permissions.
- **4 - Optimized**  
  RBAC integrated with identity governance systems; access permissions dynamically adjusted based on real-time context.
- **N/A**  
  Not applicable.

## Clarification / Extra Information

Each question must be completed either by selecting one option or by entering text.