RISK-0007 Excessive Access to Sensitive Assets Due to Weak Access Rules

RISK-0007

Risk summary

Likelihood

4

Impact

4

Score

16

Level

High

1. 01

   Asset

   Sensitive information, production systems, repositories, business applications, privileged administration paths, and restricted physical areas.

   Business object or system that needs protection.
2. 02

   Threat

   Unauthorized access, insider misuse, compromised user account abuse, accidental disclosure, or uncontrolled physical/logical access.

   Event, actor, or condition that can create harm.
3. 03

   Vulnerability

   Access is granted without role-based rules, business need, asset-owner approval, least privilege, review cadence, or exception handling.

   Weakness that makes the threat relevant.
4. 04

   Risk

   Because access rules are not clearly defined, approved, and reviewed, users may have more access than their role requires across sensitive systems, data, repositories, or locations.

   Scenario evaluated with likelihood, impact, and ownership.
5. 05

   Treatment

   Mitigate through access-control rules, role/access matrices, least privilege, owner approval, periodic access reviews, privileged-access review, and exception tracking.

   Decision path for reducing, accepting, transferring, or avoiding risk.

Controls that treat the risk

• ISO27001-A.5.15 Access Control
• A.5.15 Access Control

Evidence that proves operation

• Access Control Matrix
• Access Review Checklist
• A.5.15 Audit Evidence Pack

Assessment Rationale

Likelihood

The likelihood is high because access naturally accumulates when roles, systems, projects, and suppliers change. Without defined access rules, excessive access becomes the default state.

Impact

The impact is high because excessive access expands breach impact, weakens segregation of duties, increases insider-risk exposure, and creates audit findings across ISO 27001, SOC 2, and NIS2-aligned programs.

Residual Risk

After treatment, residual risk is estimated as medium when access rules are mapped to assets, reviews produce corrections, and privileged access is tested separately.

Review Notes

Review after major system changes, role/profile changes, supplier onboarding, access review findings, and access-related incidents.

Software Object Mapping

• risk
• access
• control
• evidence