CAIQ IAM-05: Least privilege

What the control asks

IAM-05.1: Is the least privilege principle employed when implementing information system access?

NIST defines least privilege as restricting access privileges "to the minimum necessary to accomplish assigned tasks." The question applies to people and to the processes acting for them: service accounts, CI jobs and API tokens.

Which policy usually proves it

The Access Control Policy. Most include a sentence naming the principle. Reviewers then look for how it is applied: access by role or group rather than one by one, admin rights only where needed, and narrow scopes for tokens. Those details often sit in engineering docs rather than in the policy.

Quoted evidence from public policies

Tailscale states the principle in the policy's first line:

Tailscale limits access control based on job requirements, following the principle of least privilege.

Tailscale, Access control policy, CC0.

and applies it to admins:

Personnel who have administrative system access must use other less powerful accounts for performing non-administrative tasks.

Tailscale, Access control policy, CC0.

GitLab applies it to a specific, sensitive data set:

Access to audit log data must be limited based on the principle of least privilege.

GitLab Handbook, Audit Logging Policy, CC BY-SA 4.0.

PostHog's engineering handbook shows least privilege for machine identities, which many policies forget:

Classic PATs are blocked org-wide.

PostHog Handbook, Engineering security, MIT.

(PATs are GitHub personal access tokens. The same section tells engineers to use a narrowly scoped GitHub App for each job instead.)

How GitLab answered

Yes, in its CAIQ v4.0.3 submission on the CSA STAR Registry. Its explanation for the neighboring control IAM-06 says it runs access management under the principle of least privilege.

A good answer, if your policy supports it

IAM-05.1: Yes. Access is granted by role through groups in [identity provider], limited to what each role needs. Administrators use separate admin accounts for admin tasks. CI and service tokens are scoped to a single repository or service. See Access Control Policy, section 2.

When N/A is honest

Never for your own staff and systems. If the question is read as being about your customers' users inside your product, that part is the customer's responsibility (mark the ownership column accordingly), but your own access still needs a Yes, Partially or No.

Where answers usually go wrong

• Everyone is an admin. Common in early teams. If every engineer has full production access, answer Partially and say what limits exist (for example, logging and a short list of people).
• Only the principle, no practice. One sentence naming least privilege is proof that a rule exists. Reviewers increasingly ask how it is applied, so a second sentence about roles or groups is worth adding to your policy.