How to answer 'Is access granted on the principle of least privilege?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Describe Role-Based Access Control (RBAC), how roles are approved (manager + security owner sign-off), and how temporary elevated access (break-glass/just-in-time) is requested and expired.
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · IAM-01
Yes. Access to production systems is governed by Role-Based Access Control (RBAC) configured to least privilege. Temporary elevated access requires manager approval and automatically expires within 8 hours (SOC 2, CC6.2).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default