Role-Based Access Profile Matrix
Defines standard access bundles per role so requests are approved against a baseline rather than case by case.
Available soon
- Format
- Excel
- Size
- 77 KB
- Length
- 12 sheets
- Version
- 2.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the base and seven role profiles with their system owners' approvals and review dates, a matrix view, a conflict check of every profile and every mover's resulting access (JML-06), and the method for building profiles with the example's coverage.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the values at the top of the Profile Matrix sheet: the as-at date, the months between profile reviews (JML-03), the share of a role that must hold and use a right before it joins a profile, and the staff in the HR record. The EXAMPLE uses 2026-09-30; use today's date for your own review. |
| 2 | List the systems that hold accounts on the Lists sheet (System ID, name, owner and how people sign in), from the system inventory the Joiner-Mover-Leaver Operating Procedure keeps. Every system in a profile must be there, so its owner shows beside each right. |
| 3 | Build each profile with the method on the Build profiles sheet: start from the largest roles, keep only what most of the role holds and uses, and have each system owner strike out what the role does not need. |
| 4 | Enter one row per right on Profiles: the profile, the job role, the profile owner, the number of people in the role, the system and the right in the system's own words. Record the system owner's approval and its date. Mark a right Privileged if it gives administrator access: the check then refuses it, because privileged access follows the Privileged Access Standard (JML-16). |
| 5 | List the Segregation of Duties Conflict Matrix's conflicts that your profiles could combine on the Conflict Check sheet, each with the two rights in the system's words. Every profile is checked against them, and a profile that holds both duties must be split (JML-03). |
| 6 | Before a mover's change is made, enter it in the mover check on the Conflict Check sheet: the old profile, the new one and whether any old access will still be held. The check looks at everything the person will hold, not the new profile alone (JML-06). A conflict is never granted unless P02 has accepted it as an exception (SD-04). |
| 7 | Clear every Check on Profiles that does not say "Ready for profile". Review each profile every [[12]] months and after a reorganisation or a new core system; record the new date in "Approved or last reviewed". |
| 8 | To clear the EXAMPLE, delete the contents of the Example column and of every yellow cell on Profiles, the matrix headings and the Conflict Check; keep the formulas in the white columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. It adopted the process on 1 Jul 2026 with the base profile and 7 role profiles covering 701 of 900 staff. None holds a conflict. In September a payments officer (M-01) moved from accounts payable and kept the old profile; the mover check shows the High conflict SOD-FI-01 that the request should have stopped. Mover requests now replace the old profile by default (JML-08), and the conflict check covers the person's resulting access (JML-06).
Adapting for a small organisation: start with the three or four roles that hold most staff and leave everyone else on the base profile with non-standard access. Keep the system owner's approval and the conflict check for every profile, however few.
Adapting for a regulated entity (NIS2, DORA): the approved profiles are the record that access is assigned on need-to-know and least privilege, with separation of duties (Implementing Regulation (EU) 2024/2690 Annex 11.2; Delegated Regulation (EU) 2024/1774 Article 21(a) and (b)). Keep each approved version.
Adapting where a service provider runs your IT: the provider builds the groups that carry each profile. The profile owner and the system owners stay inside your organisation and approve the content; the provider never adds a right to a profile on request.
Profiles
One row per access right in a profile: the base profile everyone receives, then one profile per job role. Yellow columns are inputs; white columns calculate. A profile never holds a privileged right or both duties of a conflict (JML-03).
| Example | Profile ID | Job role | Profile owner | People in role | System ID | System (calc) | Access right, in the system's words | System owner (calc) | System owner approved | Approved or last reviewed | Privileged | Next review (calc) | Key (calc) | Conflict in this profile (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | BP-00 | Everyone (base profile) | Head of IT | 900 | SYS-07 | Directory and single sign-on (staff accounts) | Staff account and single sign-on | Head of IT | Yes | 1 Jul 2026 | No | 1 Jul 2027 | BP-00|SYS-07|Staff account and single sign-on | Ready for profile | |
| EXAMPLE | BP-00 | Everyone (base profile) | Head of IT | 900 | SYS-06 | Email and office apps (P06 SUP-005) | Mailbox and office apps | Head of IT | Yes | 1 Jul 2026 | No | 1 Jul 2027 | BP-00|SYS-06|Mailbox and office apps | Ready for profile | |
| EXAMPLE | RP-01 | Warehouse operative | Head of Logistics | 520 | SYS-02 | Warehouse management system | Picker (handheld) | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-01|SYS-02|Picker (handheld) | Ready for profile | |
| EXAMPLE | RP-02 | Warehouse team leader | Head of Logistics | 48 | SYS-02 | Warehouse management system | Team leader: pick lists and stock moves | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-02|SYS-02|Team leader: pick lists and stock moves | Ready for profile | |
| EXAMPLE | RP-02 | Warehouse team leader | Head of Logistics | 48 | SYS-08 | Pallet network booking portal (P06 SUP-009) | Booking user | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-02|SYS-08|Booking user | Ready for profile | |
| EXAMPLE | RP-03 | Customer service agent | Chief Operating Officer | 60 | SYS-01 | ERP (hosted; P06 SUP-004) | Order entry and customer enquiry | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-03|SYS-01|Order entry and customer enquiry | Ready for profile | |
| EXAMPLE | RP-04 | Accounts payable clerk | Chief Financial Officer | 8 | SYS-01 | ERP (hosted; P06 SUP-004) | Supplier invoice entry | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-04|SYS-01|Supplier invoice entry | Ready for profile | |
| EXAMPLE | RP-04 | Accounts payable clerk | Chief Financial Officer | 8 | SYS-01 | ERP (hosted; P06 SUP-004) | Supplier master data, including bank details | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-04|SYS-01|Supplier master data, including bank details | Ready for profile | |
| EXAMPLE | RP-04 | Accounts payable clerk | Chief Financial Officer | 8 | SYS-05 | Shared finance drive | Accounts payable folder | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-04|SYS-05|Accounts payable folder | Ready for profile | |
| EXAMPLE | RP-05 | Payments officer | Chief Financial Officer | 3 | SYS-01 | ERP (hosted; P06 SUP-004) | Payment run approval | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-05|SYS-01|Payment run approval | Ready for profile | |
| EXAMPLE | RP-05 | Payments officer | Chief Financial Officer | 3 | SYS-05 | Shared finance drive | Treasury folder | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-05|SYS-05|Treasury folder | Ready for profile | |
| EXAMPLE | RP-06 | Sales account manager | Sales Director | 40 | SYS-01 | ERP (hosted; P06 SUP-004) | Customer accounts and price lists (read) | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-06|SYS-01|Customer accounts and price lists (read) | Ready for profile | |
| EXAMPLE | RP-06 | Sales account manager | Sales Director | 40 | SYS-01 | ERP (hosted; P06 SUP-004) | Sales orders | Chief Financial Officer | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-06|SYS-01|Sales orders | Ready for profile | |
| EXAMPLE | RP-07 | Transport planner | Head of Logistics | 22 | SYS-02 | Warehouse management system | Dispatch planning | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-07|SYS-02|Dispatch planning | Ready for profile | |
| EXAMPLE | RP-07 | Transport planner | Head of Logistics | 22 | SYS-08 | Pallet network booking portal (P06 SUP-009) | Booking user | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-07|SYS-08|Booking user | Ready for profile | |
| EXAMPLE | RP-07 | Transport planner | Head of Logistics | 22 | SYS-10 | Freight rate comparison site | Rate search user | Head of Logistics | Yes | 1 Jul 2026 | No | 1 Jul 2027 | RP-07|SYS-10|Rate search user | Ready for profile |
Profile Matrix
Profile matrix
The profiles side by side: each right down the side, each profile across. "Yes" means the right is in the profile on the Profiles sheet. Yellow cells are yours: the settings, the profile IDs across the top and the rights down the side.
Settings
| Setting | Value | Note | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| As-at date | 30 Sep 2026 | EXAMPLE: the quarter end. Reviews due before it show as overdue. | ||||||||||||
| Months between profile reviews (JML-03) | 12 | [[12]] in the Access Control Policy. Change it there first. | ||||||||||||
| Share of a role that must hold and use a right | 80% | Step 2 of the method on Build profiles. | ||||||||||||
| Staff in the HR record | 900 | For the coverage figure on Build profiles. | ||||||||||||
| Base profile ID | BP-00 | The profile everyone receives; the mover check adds it to every person's access. | ||||||||||||
Rights by profile
Profile IDs across the top are yours to enter; the role, the rights held and the people calculate.
| System | Access right | BP-00 | RP-01 | RP-02 | RP-03 | RP-04 | RP-05 | RP-06 | RP-07 | Profiles holding it (calc) | ||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Job role (calc) | Everyone (base profile) | Warehouse operative | Warehouse team leader | Customer service agent | Accounts payable clerk | Payments officer | Sales account manager | Transport planner | ||||||
| SYS-07 | Staff account and single sign-on | Yes | 1 | |||||||||||
| SYS-06 | Mailbox and office apps | Yes | 1 | |||||||||||
| SYS-01 | Order entry and customer enquiry | Yes | 1 | |||||||||||
| SYS-01 | Supplier invoice entry | Yes | 1 | |||||||||||
| SYS-01 | Supplier master data, including bank details | Yes | 1 | |||||||||||
| SYS-01 | Payment run approval | Yes | 1 | |||||||||||
| SYS-01 | Customer accounts and price lists (read) | Yes | 1 | |||||||||||
| SYS-01 | Sales orders | Yes | 1 | |||||||||||
| SYS-02 | Picker (handheld) | Yes | 1 | |||||||||||
| SYS-02 | Team leader: pick lists and stock moves | Yes | 1 | |||||||||||
| SYS-02 | Dispatch planning | Yes | 1 | |||||||||||
| SYS-05 | Accounts payable folder | Yes | 1 | |||||||||||
| SYS-05 | Treasury folder | Yes | 1 | |||||||||||
| SYS-08 | Booking user | Yes | Yes | 2 | ||||||||||
| SYS-10 | Rate search user | Yes | 1 |
| Rights in the profile (calc) | 2 | 1 | 2 | 1 | 3 | 2 | 2 | 3 | |
| People in the role (calc) | 900 | 520 | 48 | 60 | 8 | 3 | 40 | 22 | |
| Conflict check (calc) | Clear | Clear | Clear | Clear | Clear | Clear | Clear | Clear |
|---|
A right in many profiles may belong in the base profile; a right in one profile held by few people may be non-standard (JML-04). Privileged rights never appear here: SYS-03 and SYS-04 follow the Privileged Access Standard.
Conflict Check
Conflict check
The conflicts of the Segregation of Duties Conflict Matrix that the profiles could combine, each as the two rights that carry it. Every profile, and every mover's resulting access, is checked against them (JML-03, JML-06). Yellow cells are yours.
The conflicts to check (P02)
| Conflict ID | Rating | Duty A, as P02 words it | System A | Right A, in the system's words | Duty B, as P02 words it | System B | Right B, in the system's words | Key A (calc) | Key B (calc) |
|---|---|---|---|---|---|---|---|---|---|
| SOD-FI-01 | High | Create or change suppliers and their bank details in the finance system | SYS-01 | Supplier master data, including bank details | Approve payments | SYS-01 | Payment run approval | SYS-01|Supplier master data, including bank details | SYS-01|Payment run approval |
Every profile against every conflict (JML-03)
| Profile | Job role (calc) | Result (calc) | |||
|---|---|---|---|---|---|
| BP-00 | Everyone (base profile) | Clear | |||
| RP-01 | Warehouse operative | Clear | |||
| RP-02 | Warehouse team leader | Clear | |||
| RP-03 | Customer service agent | Clear | |||
| RP-04 | Accounts payable clerk | Clear | |||
| RP-05 | Payments officer | Clear | |||
| RP-06 | Sales account manager | Clear | |||
| RP-07 | Transport planner | Clear | |||
Mover check: the resulting access (JML-06)
Run before a mover's change is made. The check adds the base profile, the new profile and, if any old access will still be held, the old profile. "Clear" means no conflict of the list above.
| Mover | Move date | Old profile | New profile | Old access still held after the move | Conflicts in the resulting access (calc) | What to do (calc) | |
|---|---|---|---|---|---|---|---|
| M-01 | 7 Sep 2026 | RP-04 | RP-05 | Yes | SOD-FI-01 | Do not grant. Remove the old access first, or accept the conflict as a P02 exception (SD-04) | |
| M-02 | 1 Sep 2026 | RP-01 | RP-02 | No | Clear | Make the change; remove the old access by the end of the mover window (JML-08) | |
| M-03 | 14 Sep 2026 | RP-03 | RP-06 | Yes | Clear | Make the change; remove the old access by the end of the mover window (JML-08) | |
| M-04 | 21 Sep 2026 | RP-07 | RP-02 | No | Clear | Make the change; remove the old access by the end of the mover window (JML-08) | |
| M-05 | 28 Sep 2026 | RP-02 | RP-07 | No | Clear | Make the change; remove the old access by the end of the mover window (JML-08) | |
Build profiles
Build profiles from the access people already hold
A method that needs no role-mining project: the HR record's job roles, each system's own user list, and the system owners' judgement. Each step says what to keep as evidence and what the example organisation did.
The method, step by step
| Step | What to do | Rule | Evidence to keep | EXAMPLE: what the distributor did |
|---|---|---|---|---|
| 1 | List job roles from the HR record by the number of people in each. Start with the largest: a handful of roles usually covers most staff. | JML-03 | The HR extract of job roles with their headcount, dated | 7 roles, from warehouse operative (520) down to payments officer (3), cover 701 of 900 staff. The rest are in roles of a few people each and receive the base profile and non-standard access. |
| 2 | For each role, take an extract of who holds what in each system and keep only the access that at least [[80%]] of the people in the role hold and have used in the last [[90]] days. | JML-03 | Each system's extract of who holds what, with the last sign-in, and the share each right reached | Taken from each system's own user list on the day the process was adopted (1 Jul 2026). A right held by fewer than 80% of a role, or not used in the last [[90]] days, was left out of the profile. |
| 3 | Ask the owner of each system to strike out anything the role does not need for the job, in P07's sense of needed. | JML-03 | The system owner's marked-up list, signed or approved by email | Each system owner struck out what the role did not need; their approval is recorded against every row on the Profiles sheet. |
| 4 | Check the profile against the Segregation of Duties Conflict Matrix. A profile never contains both duties of a conflict (JML-03). | JML-06 | The check against the Segregation of Duties Conflict Matrix, kept with the profile | SOD-FI-01 sits across two profiles: accounts payable clerk (RP-04) holds the supplier bank details right and payments officer (RP-05) holds payment approval. No profile holds both, so the Conflict Check shows every profile Clear. |
| 5 | Leave out privileged access. It follows the privileged access pack's Standard (JML-16). | JML-16 | A note of every privileged right left out, and where it is managed instead | SYS-03 (Directory administrator groups) and SYS-04 (Online ordering admin console) hold administrator access. They follow the Privileged Access Standard and appear in no profile. |
| 6 | Name the profile owner, normally the head of the department that holds the role, and record each system owner's approval. | JML-03 | The profile owner's name and each system owner's approval, with the date | Profile owners: Head of IT, Head of Logistics, Chief Operating Officer, Chief Financial Officer, Sales Director. Every right was approved by its system owner on 1 Jul 2026. |
| 7 | Everything else a person in the role holds is non-standard: it gets an approval and an expiry (JML-04), or it is removed. | JML-04 | The non-standard requests, each with its approvers and expiry | NS-2026-031 (pricing approval report (read), expiring 12 Mar 2027) and NS-2026-033 (stock and purchasing reports (read), expiring 29 Jan 2027) were approved as non-standard, not added to a profile. |
| 8 | Review each profile every [[12]] months. Non-standard access that most of a role has held for a year is a candidate to join the profile. | JML-03 | The review record: what changed and who approved it | Each profile falls due for review on 1 Jul 2027, 12 months after approval, or sooner after a reorganisation or a new core system. |
Roles by headcount (step 1)
| Profile | Job role (calc) | People (calc) | Cumulative people (calc) | Share of staff (calc) |
|---|---|---|---|---|
| RP-01 | Warehouse operative | 520 | 520 | 58% |
| RP-03 | Customer service agent | 60 | 580 | 64% |
| RP-02 | Warehouse team leader | 48 | 628 | 70% |
| RP-06 | Sales account manager | 40 | 668 | 74% |
| RP-07 | Transport planner | 22 | 690 | 77% |
| RP-04 | Accounts payable clerk | 8 | 698 | 78% |
| RP-05 | Payments officer | 3 | 701 | 78% |
| Covered by role profiles (calc) | 701 | 78% |
|---|
Everyone else receives the base profile and, where the job needs more, non-standard access with an expiry (JML-04). Coverage of most staff by a handful of profiles is normal; aim for the largest roles first.
Inclusion test for one right (step 2)
| No. | Job role, system and right | People in role | Hold the right | Of whom used it recently | Share (calc) | Decision (calc) |
|---|---|---|---|---|---|---|
| 1 | [[e.g. Warehouse team leader: SYS-02 Team leader: pick lists and stock moves]] |
2
3
4
5
6
Share: people in the role who hold the right and used it in the last [[90]] days, out of everyone in the role. At or above the share set on the Profile Matrix sheet, the right is a candidate for the profile.
Rules
Rules this workbook applies
The rules come from the Access Control Policy and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.
| Rule | Requirement | Where this workbook applies it |
|---|---|---|
| JML-02 | Every person has one identity, and every account is linked to exactly one identity. A shared account is allowed only where a system cannot work without one, with a named owner and the system owner's approval, and is handled as P07 AR-06 sets. | Profiles are granted to a person's identity; a shared account never receives a profile. |
| JML-03 | Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every [[12]] months and after a reorganisation or a new core system. | Profiles: owner, system owner approval and next review on every row; the Check refuses a privileged right and a profile with a conflict. Build profiles: the method. |
| JML-04 | Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than [[6]] months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date. | Build profiles, step 7 and the inclusion test: what is not in a profile is non-standard, with approval and an expiry. |
| JML-05 | Nobody approves their own access, or the access of anyone who approves theirs. The person who makes the change in a system does not approve it (P02 SOD-IT-01). | System owner approved: the system owner approves the content of the profile in advance; the person who builds the groups does not. |
| JML-06 | Before any access right is granted or changed, the person granting it checks the person's resulting access, everything they will hold after the change including what they still hold from an earlier role, against the Segregation of Duties Conflict Matrix (P02 SD-03). A grant that would create a conflict is not made unless it has been accepted under P02 SD-04. | Conflict Check: every profile, and every mover's resulting access, checked against the conflicts. |
| JML-08 | A mover receives the new role's profile from the move date. The old role's access is removed on the move date or, where the old line manager records a handover, no later than [[5]] working days after it. Access still needed after that is requested as non-standard (JML-04). | Conflict Check, mover check: old access removed by the end of the mover window. |
| JML-16 | Privileged access, including administrator, emergency ("break-glass") and service accounts, follows the Privileged Access Standard of the Privileged Access Management pack. This pack sets no rule for it and puts no privileged access in a role profile. A leaver or mover who holds privileged access is handled by this pack's process, with the privileged steps the Privileged Access Standard sets. | Profiles: the Privileged column, and the note under the Profile Matrix. |
Who approves what
| Rule | Request | Approvers |
|---|---|---|
| JML-03 | Base and role profile, for a joiner or a mover | None beyond the HR record: the profile is approved in advance by its owner and the owner of each system in it. The line manager confirms which profile applies. |
| JML-04 | Non-standard access | The line manager (or the sponsor), and the owner of the system or data. With an expiry no more than [[6]] months ahead. |
| JML-04 | Renewal of non-standard access, or extension of a non-employee's end date | The same approvers as the original request, before the expiry or end date. |
| JML-06 | Access that would create a segregation-of-duties conflict | Not granted unless accepted as an exception under P02 SD-04, approved at the level P02 sets for the exception's band. At Critical that is the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. |
| P02 EX-05 | An exception to the Access Control Policy | Through the P02 exception process, approved at the level P02 sets for the band. At Critical, the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. |
| JML-16 | Privileged, emergency or service account access | As the Privileged Access Standard sets. |
Lists
| SysID | SysName | SysOwner | SysSignIn | YesNo | Rating |
|---|---|---|---|---|---|
| SYS-07 | Directory and single sign-on (staff accounts) | Head of IT | Single sign-on | Yes | High |
| SYS-06 | Email and office apps (P06 SUP-005) | Head of IT | Single sign-on | No | Medium |
| SYS-01 | ERP (hosted; P06 SUP-004) | Chief Financial Officer | Single sign-on | Low | |
| SYS-02 | Warehouse management system | Head of Logistics | Local accounts | ||
| SYS-05 | Shared finance drive | Chief Financial Officer | Single sign-on | ||
| SYS-08 | Pallet network booking portal (P06 SUP-009) | Head of Logistics | Local accounts | ||
| SYS-10 | Freight rate comparison site | Head of Logistics | Local accounts |
Columns A to D are the system list: the EXAMPLE's systems in lifecycle scope. Yellow rows: add your own. SYS-03 (Directory administrator groups) and SYS-04 (Online ordering admin console) are privileged and follow the Privileged Access Standard.
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Identity | One person, known to the organisation through the HR record or the sponsor register, to whom every account they use is linked. |
| Account | A user name in one system. A person may have several; each is linked to exactly one identity. |
| Access right | What an account may do in a system: a role, group or permission, in the system's own words. |
| Base profile | The access everyone gets on day one: an account, single sign-on, a mailbox and the office apps. |
| Role profile | The standard access for one job role, on top of the base profile, approved in advance by the profile owner and the owner of each system in it. Granted without further approval. |
| Profile owner | The manager who answers for what a role profile contains, normally the head of the department that holds the role. Approves changes to it with the system owners. |
| System owner approval | The system owner's agreement that the role needs the right, recorded with its date. A profile is used only once every right in it is approved. |
| Non-standard access | Any access right that is not in the person's base or role profile. Needs its own approval and an expiry date. |
| Segregation-of-duties conflict | Two duties one person should not hold together, as the Segregation of Duties Conflict Matrix lists them with their rating. High: one person could make and hide an unauthorised change, payment or access grant with no second person seeing it. Medium: one person could make an unauthorised change that another control would probably, but not certainly, detect later. Low: the combination is undesirable but the damage is small or detected quickly by routine checks. |
| Resulting access | Everything a person will hold after a change, including what they still hold from an earlier role. The conflict check looks at this, never at the new profile alone (JML-06). |
| Mover | A person whose job, department or line manager changes. Their new role's access is added and their old role's access is removed. |
| Residual access | Access a mover still holds from their old role after the mover window has closed. |
| Privileged access | Privileged access, including administrator, emergency ("break-glass") and service accounts, follows the Privileged Access Standard of the Privileged Access Management pack. This pack sets no rule for it and puts no privileged access in a role profile. A leaver or mover who holds privileged access is handled by this pack's process, with the privileged steps the Privileged Access Standard sets. |
| Key (calc) | The profile, system and right joined into one value, so the matrix and the conflict check can find each right. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.15 — Access control | Profiles and Rules: access granted from approved profiles on business need, with the base profile and non-standard access kept apart |
| ISO/IEC 27001:2022 | Annex A 5.18 — Access rights | Profiles: each right approved by its system owner, reviewed every 12 months; the mover check before a change |
| NIST CSF 2.0 | PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties” | The whole matrix: permissions defined, approved, checked for separation of duties and reviewed |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The profiles as part of the access control policy |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 11.2 — access rights are provided, modified, removed and documented under the access control policy: assigned and revoked on need-to-know, least privilege and separation of duties; “modified accordingly upon termination or change of employment”; authorised by the relevant persons; third-party access limited in scope and in duration; a register of access rights granted; logging of the management of access rights; and review at planned intervals | Profiles and Conflict Check: rights assigned on need-to-know, least privilege and separation of duties, authorised by the system owner |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(c) — policies that limit access to information and ICT assets to what is required for legitimate and approved functions, with controls that ensure sound administration of access rights | The profiles limit access to what each role needs (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 21(a) — access rights assigned on need-to-know, need-to-use and least privilege principles, including for remote and emergency access | Build profiles: rights included only where the role holds and uses them |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 21(b) — an access control policy with segregation of duties that prevents combinations of access rights able to circumvent controls | Conflict Check: segregation of duties checked for every profile and every mover |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.