Auditors scoping three civic entities need broad read visibility into policies, risks, and controls in scope. What access pattern is appropriate?
Select an answer to reveal the explanation.
Short Explanation
Auditors need a library card, not the master keys to rebuild the library. Read across the entities in scope is enough; full GRC admin is overkill and risky. Screenshots-only is the other extreme.
Full Explanation
Auditors scoping three civic entities need read access across policies, risks, and controls in scope without full GRC admin rights. Library-card access enables planning and fieldwork; master keys to rebuild methodologies and ACLs are unnecessary and risky. Least privilege for audit personas is standard CIS-RC access design.
Assigning sn_grc.admin to every auditor for convenience over-privileges assurance staff. Giving auditors no access to entities and requiring screenshot sharing only cripples evidence quality and efficiency. Allowing auditors to modify entity class hierarchy during fieldwork grants structural change rights unrelated to read-scoped assurance.
Exam caveat: scoped read for auditors; not admin, not screenshot-only blindness, not entity-hierarchy edit during fieldwork.
Operational check: grant read roles for in-scope entities’ policies/risks/controls; deny sn_grc.admin; deny entity class hierarchy change; validate with an auditor test account before engagement start.
Use engagement-scoped security roles or filters where available so read access covers the three entities without granting estate-wide admin. Log access reviews at engagement open and close. Screenshot-only evidence collection remains an emergency fallback, not the design.