Access control (CC6) — the most-tested area

Least privilege & RBAC (`CTL-AC-01`)

Objective: people have only the access their role needs.
Implement: define a small set of roles per system (e.g. read-only,
developer, admin). Grant access to roles, not individuals. Drive access
from groups in your identity provider so removing someone from a group removes
their access everywhere downstream.
Evidence: export the current role-to-group-to-entitlement mapping.
Pitfall: "temporary" admin grants that became permanent. Review them.

MFA everywhere that matters (`CTL-AC-02`)

Objective: stolen passwords alone can't grant access.
Implement: enforce MFA at the IdP for SSO, and require SSO for downstream
apps. For admins, prefer phishing-resistant methods (hardware keys / passkeys).
Evidence: IdP report showing MFA enrollment/enforcement at 100% of in-scope
users.
Pitfall: a few service or break-glass accounts exempt from MFA and never
reviewed.

Provisioning with approval (`CTL-AC-03`)

Objective: no self-granted access.
Implement: route access requests through a ticket or access-request workflow
where the resource owner or manager approves before the grant. The approval and
the grant should be linked.
Evidence: sample tickets showing requester, approver (different person),
date, and what was granted.
Pitfall: approvals after the fact, or the requester approving their own
request.

Deprovisioning within SLA (`CTL-AC-04`)

Objective: leavers lose access fast.
Implement: HR's termination event triggers an offboarding checklist; SSO
disablement removes most access at once. For involuntary terminations of
privileged users, disable access before notification where possible.
Evidence: termination list reconciled against deprovisioning timestamps,
proving each was within SLA.
Pitfall: you can't produce a clean termination list to reconcile against.
Fix the source list first.

Periodic access review (`CTL-AC-05`)

Included with SOC 2 Compliance Templates

Ready for the complete SOC 2 Compliance Templates?