Job or Duties Review

It is important to recognize that changes in business needs, threats, risk assessments, and the risk profiles and activities of specific identities-whether individuals, virtual entities, or devices-can all trigger modifications to user permissions.

Privilege creep occurs when user identities accumulate permissions required for new tasks, duties, or responsibilities, but fail to relinquish permissions that are no longer necessary. Left unchecked, this can increase organizational risk, as users with excessive permissions may, intentionally or unintentionally, take actions that disrupt system operations or expose the information assets to threats.

User identities often undergo changes in job roles, functions, or responsibilities. These changes typically affect the assets to which users need access and should result in corresponding adjustments to their permissions. For instance, the completion of major projects and tasks should prompt a downgrade in permissions related to those efforts. Similarly, an increase in managerial responsibility may necessitate access to higher-level supervisory or leadership information, while access to operational data from previous roles should be reduced.

An accounting clerk who advances to the role of CFO, for example, should no longer retain permissions to initiate payments. This illustrates the importance of applying the principles of least privilege, need-toknow, and separation of duties as key design considerations in access control systems.

Each change in employment status, job assignment, or responsibility should prompt a permissions review.

Doing so helps prevent privilege creep and reduces risk exposure.