A city grants every IT analyst the GRC admin role for convenience. What role practice should the implementer enforce instead?
Select an answer to reveal the explanation.
Short Explanation
Handing everyone the master key because it is convenient is how configurations get quietly rewritten. Day-to-day owners need manager or user personas; admin stays with the people who configure. Least privilege is a planning decision, not a nicety.
Full Explanation
GRC admin roles are intended for implementation and ongoing configuration, not routine attestation or risk assessment work. Planning should map analysts and business owners to appropriate manager/user roles and groups. Broad admin grants violate least privilege and increase accidental or unauthorized model changes.