Is the least privilege principle employed when implementing information system access?

Question taken from a real document : donneur d'ordre

Question reproduced verbatim: Is the least privilege principle employed when implementing information system access?
Source document: Cloud Security Alliance, Consensus Assessments Initiative Questionnaire (CAIQ) v4.0.2, 261 questions
Reference within the document: IAM-05.1
Source: Open the document

Why your client asks you this

This question comes from a supplier questionnaire sent by a customer. It is not distrust: the customer is himself required to ask. An obligation placed on him flows down to you through the contract.

This point can be substantiated by a technical check

We can measure the actual state of your Microsoft 365 configuration here. Your answer can rest on a dated fact rather than on an impression.

What makes an answer solid

European law does not say “declare”, it says “demonstrate”. That is the difference between a ticked box and a dated fact.

met à la disposition du responsable du traitement toutes les informations nécessaires pour démontrer le respect des obligations prévues au présent article et pour permettre la réalisation d'audits, y compris des inspections, par le responsable du traitement ou un autre auditeur qu'il a mandaté, et contribuer à ces audits.

Read the official text

Check before you answer

You can check, free of charge, in seconds and without any access to your systems, the public configuration of your mail domain. It is the first point most questionnaires raise, and it can be verified from the outside.

Run the free check