Access control · 11 answer guides
How to answer access control questions in a security questionnaire
MFA, SSO, least privilege, access reviews, and offboarding. Buyers want to know who at your company can reach production and customer data, and how you would prove it. Sloppy answers here make them doubt everything else.
Multi-factor authentication
Describe your multi-factor authentication (MFA) implementation.Single sign-on (SSO) and SAML
Do you support Single Sign-On (SSO) or SAML integration?Least privilege
Do you implement the least privilege principle for system access?Role-based access control
How do you implement role-based access control (RBAC)?Privileged access management
How do you handle privileged access management (PAM)?Access provisioning and deprovisioning
What is your process for user access provisioning and deprovisioning?Access reviews
How frequently are access rights reviewed?Authentication and authorization
How do you manage user authentication and authorization?Password policy
Describe your password/credential policies (length, complexity, rotation).Password storage and hashing
How are user passwords stored and protected (hashing algorithms, salting)?Access log monitoring
How do you monitor and review access logs?