Custom RBAC roles should not be used

NIST SP 800-53 Rev 5

• AC-2 Account Management
• AC-2(7) Privileged User Accounts
• AC-6: Least Privilege
• AC-6(7) Review of User Privileges

NIST Cybersecurity Framework v2.0

• GV.RR-01: Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving.

FedRAMP Moderate Baseline Rev 4

• AC-2 (3): Disable Inactive Accounts
• AC-2(7) Role-Based Schemes
• AC-6 (5): Privileged Accounts

NIST SP 800-171 Rev 2

• 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
• 3.1.5: Employ the principle of least privilege, including for specific security functions and privileged accounts.

RBI IT Framework for NBFCs

• 3.1.a Identification and Classification of Information Assets
• 3.1.f Maker-checker

CMMC 2.0 Level 2

• AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
• AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
• AC.L2-3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts

FedRAMP High

• AC-2 Account Management
• AC-2(7) Role-Based Schemes
• AC-6 Least Privilege
• AC-6(7) Review Of User Privileges

HIPAA HITRUST v9.2

• 1148.01c2System.78-01.c 01.02 Authorized Access to Information Systems
• 1230.09c2Organizational.1-09.c 09.01 Documented Operating Procedures

PCI DSS v3.2.1

• 7.2.1 Confirm that access control systems are in place on all system components
• Do not store sensitive authentication data after authorization (even if encrypted)
• Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access