UnixTime

Research Note

Access Control Matrix

  • Updated Jun 17, 2026
  • Read 01 min read
  • Status reviewed

Use this to define standard access rights by role, asset, classification, and approval owner.

On this page

When to use this

Practical use

Use this as a working artifact. Fill it with real owners, dates, decisions, evidence locations, and review status.

Use this to define standard access rights by role, asset, classification, and approval owner.

Matrix

Role/profile Asset/system/location Classification/sensitivity Access level Business need Approver/owner Review frequency Notes
TBD TBD TBD Read / Write / Admin / Physical TBD TBD TBD TBD

Design checklist

  • Access is based on business need.
  • Least privilege is applied.
  • Need-to-know and need-to-use are considered.
  • Asset owner or authorized role approves access.
  • Sensitive assets have tighter access controls.
  • Privileged access is separated and monitored.
  • Role profiles are reviewed periodically.
  • Physical access is included where relevant.
  • Template
  • Iso27001
  • A5 15
  • Access control

Note Metadata

Aliases: Role-Based Access Matrix

Source: 90 Templates/Access Control Matrix.md

Graph-sourced resources

Templates and evidence

Auditor evidence packs

Evidence collections and audit-facing verification material.