CAIQ v4
Control IAM-01
Extractive Review Standard
How to answer 'Is access granted on the principle of least privilege?' on a CAIQ
Reviewer Guidance & Pitfalls
Describe Role-Based Access Control (RBAC), how roles are approved (manager + security owner sign-off), and how temporary elevated access (break-glass/just-in-time) is requested and expired.
Example Answer Passing Enterprise Audit
Compliant Response Template
Yes. Access to production systems is governed by Role-Based Access Control (RBAC) configured to least privilege. Temporary elevated access requires manager approval and automatically expires within 8 hours (SOC 2, CC6.2).
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire automatically drafts answers with citations from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
Zero spam. 100% confidential. No credit card required.