IAM-015 Role-Based Access Control
Description
Access to systems and data is granted through defined roles rather than to individual accounts. A role catalogue records each role, the permissions it carries and its owner, and is reviewed at defined intervals. Access granted outside the role model is recorded as an exception with a documented justification and an expiry date.
Rationale
Role-based assignment reduces administrative overhead and makes access reviews tractable: a reviewer certifies a role once rather than every permission on every account. Issued in S2 when IAM-006 was split (CQ-031, ADR-033). Segregation of duties between roles, including conflicting role pairs, is GOV-009. Least-privilege scoping of what each role may do is IAM-005.
Applicability (9 profiles)
Framework Mappings (11)
| IAM-15 | Authorization Mechanisms | partial |
| IAM-15 | Authorization Mechanisms | partial |
| HIPAA-164.308.a.4.i | Information Access Management | informative |
| HIPAA-164.308.a.4.ii.B | Access Authorization | informative |
| HIPAA-164.312.a.1 | Access Control | full |
| 5.15 | Access control | partial |
| NIS2-CIR-11.3 | Privileged Accounts and System Administration Accounts | informative |
| AC-2(7) | Account Management | Privileged User Accounts | partial |
| AC-24 | Access Control Decisions | partial |
| AC-6(1) | Least Privilege | Authorize Access to Security Functions | full |
| CC6.3 | Role-Based Access Controls and Least Privilege | partial |
Evidence (1)
Role catalogue export from the identity provider or authorisation platform listing each defined role, the permissions it carries, its owner and the current user-to-role assignments.
Example: Identity provider group or role export listing every defined role with its permissions and members, with the role owner and last review date recorded in the access management system.
Test: Export the role catalogue and current user-to-role assignments. Verify: (1) access is assigned through roles rather than directly to individual accounts wherever the platform supports role assignment, (2) each role has a named owner and a review date within the defined interval, (3) any direct grant outside the role model has a recorded justification and expiry date, (4) the permissions of a sample of roles match their catalogue entry.
Questions (2)
Is access to systems and data assigned through defined roles rather than granted directly to individual users?
Role-based assignment must be the default. Direct individual-level grants should be exceptions with documented justification, not the norm.
Which of the following describe your role-based access model?
Direct grants to individual accounts are exceptions, not the norm; each one needs a recorded justification and expiry date. The role catalogue export is the evidence.