What is the recommended basis for assigning user privileges to system components?

What is the recommended basis for assigning user privileges to system components?

• A. Privileges should be granted by personal preference
• B. Privileges should be revised only during annual audits
• C. Privileges should be assigned based on job classification and function
• D. Privileges should be universal for all users regardless of role

Answer: (C)

Assigning privileges by role and function ensures privileges align with what a person actually needs to perform their job. This implements the principle of least privilege and supports consistent, auditable access control. By defining roles that reflect specific responsibilities and mapping those roles to the minimum set of permissions, you minimize the risk of over-privilege, reduce potential damage from mistakes or compromised accounts, and make it easier to enforce separation of duties. In practice, you’d document each role’s required system access, implement role-based access control, and regularly review and adjust permissions as job duties change or people leave, ensuring access stays appropriate over time. Choosing privileges by personal preference leads to inconsistent controls and weak governance. Reviewing access only at annual audits leaves gaps when roles change or employees move, creating exposure. Making privileges universal for all users completely defeats the purpose of access control and greatly increases risk.

Assigning privileges by role and function ensures privileges align with what a person actually needs to perform their job. This implements the principle of least privilege and supports consistent, auditable access control. By defining roles that reflect specific responsibilities and mapping those roles to the minimum set of permissions, you minimize the risk of over-privilege, reduce potential damage from mistakes or compromised accounts, and make it easier to enforce separation of duties.

In practice, you’d document each role’s required system access, implement role-based access control, and regularly review and adjust permissions as job duties change or people leave, ensuring access stays appropriate over time.

Choosing privileges by personal preference leads to inconsistent controls and weak governance. Reviewing access only at annual audits leaves gaps when roles change or employees move, creating exposure. Making privileges universal for all users completely defeats the purpose of access control and greatly increases risk.