Security questionnaire answers › Access control
Do you apply the principle of least privilege? How to answer it in a security questionnaire
Why buyers ask this
Buyers want to know staff and systems only get the access they need to do their jobs.
What a strong answer includes
- Explain role-based access and how roles are defined.
- Say how production data access is restricted.
- Mention periodic recertification.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. Access is role-based and granted on a need-to-know basis. Engineers do not have standing access to production customer data, and access to sensitive systems requires approval and is reviewed [quarterly].
Evidence to attach
- Role definitions
- Access review record
- Production access procedure
Common mistakes
- Generic wording with no mention of how access is actually granted or reviewed.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.