SFS 4 / SF 5

Back to SFS 4

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are access controls applied to organization-owned data files and directories to enforce least privilege based on user roles and data classification throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Access controls restrict data access to authorized roles according to classification levels

Assessment criterion and evidence

Actor: Organization. Scope: Organization-owned data files and directories across local, network-attached, and cloud storage systems. Evidence period: Throughout the review period. Required evidence: Documented access control policies; Configuration records showing role-based restrictions; Audit logs verifying enforcement. Negative criterion: Improper permissions allow unauthorized access to classified data. Missing evidence: Pending assessment when evidence of access control configurations is unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.