Access Control Design Drill
Key Takeaways
Subdomain 3.2 names least privilege, separation of duties, and access control models.
Give each account only the access its role needs.
Separate duties that could be abused by one person.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomains 3.1 and 3.2, checked 2026-10-22.
The Drill
A new employee needs access on the first day. Start from the role (subdomain 3.1), grant the minimum access the role needs (least privilege, subdomain 3.2), and check that no single person holds both the request and the approval for a sensitive action (separation of duties, subdomain 3.2).
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomains 3.1 and 3.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 3.1: Roles definition
- 3.1: Provision
- 3.1: Review
- 3.1: Deprovision
- 3.1: Frameworks and tools
- 3.2: Principle of Least Privilege (PoLP)
- 3.2: Separation of Duties (SoD)
- 3.2: Access control models
Common Traps
A common trap is provisioning before the role is defined. Roles come first; access follows the documented role and is reviewed and removed when it is no longer needed.
Which design best applies separation of duties to a payment approval?
One person requests the payment and a different person approves it
One person requests and approves the same payment, which keeps the process fast
Everyone in the team can approve every payment, so approvals never wait
The approval is skipped for urgent payments, so the money moves quickly
Working the Drill
Design access for one role in four moves. Define the role and the business need. Grant only the permissions the role requires, which is least privilege. Check that the request and the approval belong to different people, which is separation of duties. Review the access on a schedule and remove it at deprovisioning. Each design choice should be traceable to one of those moves.
Sections you finish are checked off in the contents.