// ITSP.10.171 · FAMILY 01 · 16 REQUIREMENTS

Access control

Last verified: 2026-10-05

// REQUIREMENTS

Identifier	Requirement	Level 1
03.01.01	Account management	Level 1
03.01.02	Access enforcement	Level 1
03.01.03	Information flow enforcement
03.01.04	Separation of duties
03.01.05	Least privilege
03.01.06	Least privilege (privileged accounts)
03.01.07	Least privilege (privileged functions)
03.01.08	Unsuccessful logon attempts
03.01.09	System use notification
03.01.10	Device lock
03.01.11	Session termination
03.01.12	Remote access
03.01.16	Wireless access
03.01.18	Access control for mobile devices
03.01.20	Use of external systems	Level 1
03.01.22	Publicly accessible content	Level 1

// INTENT

The right people reach the right data and nothing more.

// WHAT A FIRST ASSESSMENT FINDS

Everyone in the "Engineering" group can reach everything Engineering ever made, 3 departed employees still have live accounts, and the shared "shop floor" login has been running since 2019.

// THE WORK

Least privilege applied to the enclave. Role-based groups scoped to need, a joiner-mover-leaver process that fires the day someone changes roles, no shared accounts touching Specified Information, and remote access that terminates on the enclave's edge under MFA. Quarterly access reviews with a dated record turn this family from a hope into evidence.

// HOW WE CAN INTERPRET IT

This is the confidentiality corner of the CIA triad, and the plain reading is role-based access with least privilege. Ask what information is reachable, from where, and by whom. I've watched a multinational integrator that works in defense put everything on SharePoint with a single rule, that any technician can open anything because it might be needed. That doesn't fly. Two project managers on 2 different projects don't need each other's folders. The CFO doesn't need the CAD drawings. The hardware team placing components on PCBs doesn't need the source tree, and the developers don't need the board layouts. Take the tasks, build roles from them, and assign access to groups, never to individuals, even when the group holds one person. Project A developer access, project A hardware access, project A master access, with master held by the few people cleared for it. Being the owner of the company is not a role, and if the owner's account is breached, ownership is exactly the problem.

// TEMPLATES FOR THIS FAMILY

References

Protecting specified information in non-Government of Canada systems and organizations (ITSP.10.171)April 2025, updated October 2025
Canadian Centre for Cyber Securitycyber.gc.caRetrieved Oct 5, 2026
NIST SP 800-171 Revision 3, Protecting Controlled Unclassified Information in Nonfederal Systems and OrganizationsRevision 3
NISTcsrc.nist.govRetrieved Oct 5, 2026

Outbound links open in a new tab. Source-pinned. If a vendor moves a doc, this block gets updated.