Has your organization implemented a least privilege access model that restricts user access and privileges to only what is necessary for their job functions?

Least privilege access control ensures users have only the minimum permissions needed to perform their job functions, reducing the potential attack surface and limiting the impact of compromised accounts. This approach is a core principle of zero trust architecture, where no user or system is inherently trusted, and verification is required for all access requests regardless of location or network.

Evidence of implementation could include access control policies, role definitions with associated permission sets, documentation of periodic access reviews, and logs showing privilege elevation processes. A comprehensive privilege management matrix mapping job roles to specific system access levels would be particularly valuable evidence.