← CIS Controls v8 in plain English

6.8 IG3

Control 6 / Access Control Management

Define and Maintain Role-Based Access Control

Think of it likeDeciding which family members get keys to different rooms based on their responsibilities.

In plain English

Who needs access to what is defined by role and reviewed regularly, so everyone holds only the access their job requires.

Related CSF subcategories (unofficial mapping)