Unseated access
A Worker unseated from a Role holds none of that Role’s Permissions from the moment it leaves.
Satisfies
| Criterion | Text |
|---|---|
| SOC2 CC6.2 | The entity registers and authorizes new users before issuing credentials, and removes credentials once access is no longer authorized. |
| SOC2 CC6.3 | The entity authorizes, modifies or removes access based on roles, least privilege and segregation of duties. |
| ISO27001 A.6.5 | Security responsibilities that remain after termination or a change of job are defined and enforced. |
| HIPAA 164.308(a)(3) | Workforce members get appropriate access to electronic protected health information, and others are prevented from obtaining it. |
Implemented by
Test
| Step | Rule |
|---|---|
| Kind | Detective: it finds the failure after it happens. |
| Select | Every Worker unseated from a Role in the report period. |
| Assert | The set of Actions it ran under that Role after unseating is empty. |
Owner
Security Engineer, Engineering Team.
Example
A Human leaves the Billing Specialist seat at 17:00. A refund attempt under that Role at 17:01 ends refused.