Define policy & use least privileged roles
Implementation Effort: Medium – IT and security teams must develop a policy, analyze current role assignments, and update processes to align with least privilege principles.
User Impact: Low – Most users will not notice a change, but administrators may receive more narrowly scoped role assignments based on defined tasks.
Overview
Defining and enforcing a policy for least privileged role assignment helps organizations reduce risk and maintain control over access to sensitive systems. This process begins by creating a formal written policy that defines how roles should be granted based on actual job responsibilities. IT teams then need to analyze how roles are currently used across the organization, identifying cases where users have more access than needed. With this insight, business processes must be updated so that all future role assignments follow the least privilege model—only granting users the permissions necessary for the tasks they perform. This work supports the Zero Trust principle of "Use least privilege access" by limiting standing access and making sure assignments are intentional and appropriate. It also reinforces "Verify explicitly" because role-based decisions are linked to validated job functions, and "Assume breach" by reducing the blast radius if a privileged account is compromised. Without this effort, organizations risk granting excessive access that can be misused by insiders or exploited by threat actors.