SFS 3 / SF 5

Back to SFS 3

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are role-based access controls consistently implemented for all non-administrative user groups throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented role definitions enforced consistently across all applicable systems

Assessment criterion and evidence

Actor: Organization. Scope: Non-administrative user groups accessing standard resources. Evidence period: Throughout the review period. Required evidence: Documented role definitions matching system configurations; Audit logs demonstrating consistent permission application. Negative criterion: Ad-hoc permission assignments or inconsistent role implementation observed. Missing evidence: Pending verification when evidence is unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.