Audit — AC-3 — Access Enforcement

Examine Examine the access control policy and system configuration to confirm an enforcement model (e.g., RBAC, ABAC, or ACL-based) is defined and that a default-deny posture is applied so access is denied unless explicitly authorized.

Test Using a test account lacking authorization, attempt to access a protected resource (file share, application function, database) and confirm the system denies the access.

Examine For a sample of protected resources, compare the enforced access settings (group memberships, ACLs, application role assignments) against the documented approved authorizations and confirm they match with no unauthorized grants.

Test For a sample user, enumerate effective permissions and confirm they align to the user's assigned role(s) only, with no residual or excess entitlements beyond what enforcement should allow.

Interview Ask administrators to describe how approved authorizations are translated into enforced technical controls and how they validate that enforcement reflects current authorizations.

Examine Confirm role-based access control is implemented on critical systems and that access decisions are enforced centrally where feasible rather than configured ad hoc per host (CIS v8 6.7, 6.8).

Test Change a test user's role or group membership and confirm the resulting access change is enforced (granted or revoked) at the resource on next authentication/session.