Restricting access to information usually means role-based permissions enforced by the system itself, not a spreadsheet describing who should have what. Auditors check whether a new hire's access is granted from a defined role rather than copied from whichever colleague sits nearby, since copied access is how permissions creep accumulates unnoticed over years. For multi-tenant applications, the same principle extends to customer data: every query is scoped to the requesting tenant at the platform layer, so a bug in application code cannot expose one customer's records to another. The common failure mode is an admin panel or reporting tool that bypasses the role model entirely because it predates the access control policy.
Common gaps
New hires are provisioned by copying an existing colleague's access rather than assigning the role-defined permission set, so access rights drift from what the policy describes.
A reporting tool built before the access control policy still queries the database directly, bypassing the role-based permissions enforced everywhere else.
Tenant scoping is enforced in the main application, but a support tool used by staff can query across tenants without the same restriction.
Questions your auditor will ask
How is access to information assigned when someone joins or changes role?
Access is granted from a defined role rather than copied from a colleague, so what a person can reach maps directly to their role definition.
Is access control enforced by the system, or does it rely on people following the rules?
It is enforced by the platform itself, with no shared logins or honor-system access substituting for real access control.
How do you prevent one customer's data from being reachable by another in a shared system?
Every data query is scoped to the requesting tenant, and isolation is enforced at the platform layer so a bug in application code cannot expose another customer's data.
Where regulation demands it
NIS2 art. 11.2 requires management of access rights based on role, and ENS op.acc.4 requires a defined process for granting and revoking access rights.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.