Sensitive Role Identification Checklist

1. Purpose

The Sensitive Role Identification Checklist provides a structured method for identifying roles that may require enhanced security controls because of their access to:

Sensitive or restricted information
Production systems
Privileged accounts
Security systems
Source code
Cloud infrastructure
Financial systems
Customer information
Personal data
Critical business processes
Security credentials or secrets

The objective is to ensure that personnel performing sensitive roles receive appropriate:

Background screening
Access controls
Security responsibilities
Training
Monitoring
Periodic review
Re-screening where applicable

Core Principle

Identify Role → Assess Access → Assess Information → Assess Impact → Determine Sensitivity → Apply Controls → Review

2. When to Use

Use this checklist:

During new role creation
During recruitment
Before granting privileged access
During employee onboarding
During role changes
During access reviews
During security reviews
During background screening
During supplier/contractor onboarding
When systems or information classifications change
When a role receives production access
When a role becomes responsible for critical security functions

3. Role Information

Field	Details
Assessment ID
Role Title
Department
Role Owner
Business Owner
Manager
Assessment Date
Assessor
Employment Type
Location
System/Process
Role Description
Review Date

4. Role Classification

Select the applicable category:

☐ Standard Role
☐ Sensitive Role
☐ Security-Sensitive Role
☐ Privileged Role
☐ Critical Role
☐ Regulatory/Compliance-Sensitive Role
☐ Financially Sensitive Role
☐ Customer-Data Sensitive Role
☐ Production-Access Role
☐ Cloud-Administrative Role

Multiple classifications may apply.

5. Information Access Assessment

Determine whether the role can access:

Information

☐ Public information
☐ Internal information
☐ Confidential information
☐ Restricted information
☐ Personal data
☐ Sensitive personal data where applicable
☐ Customer information
☐ Financial information
☐ Payment information
☐ Security information
☐ Authentication information
☐ Encryption keys
☐ API keys
☐ Source code
☐ Intellectual property
☐ Vulnerability information
☐ Incident information
☐ Business continuity information

Highest Classification

Highest information classification: __________________

6. System Access Assessment

Determine whether the role has access to:

☐ Corporate applications
☐ SaaS applications
☐ Cloud platforms
☐ Production systems
☐ Development environments
☐ Databases
☐ Source-code repositories
☐ CI/CD systems
☐ Network infrastructure
☐ Security tools
☐ Endpoint management
☐ Identity systems
☐ Backup systems
☐ Monitoring systems
☐ Logging platforms
☐ Financial systems
☐ Customer-facing systems

7. Privileged Access Assessment

Determine whether the role can:

☐ Create users
☐ Delete users
☐ Modify permissions
☐ Grant privileged access
☐ Disable security controls
☐ Change security configurations
☐ Modify firewall/network rules
☐ Modify cloud infrastructure
☐ Modify production databases
☐ Deploy production software
☐ Access administrative consoles
☐ Reset authentication mechanisms
☐ Manage encryption keys
☐ Manage secrets
☐ Modify logging or monitoring
☐ Modify backup/recovery configuration

Privileged Access Required?

☐ Yes
☐ No

If yes, document justification:

8. Cloud Access Assessment

For cloud environments such as AWS:

☐ AWS account access
☐ IAM administration
☐ Organization/account management
☐ Production account access
☐ EC2 administration
☐ RDS/database administration
☐ S3 data access
☐ KMS/key management
☐ Secrets Manager access
☐ CloudTrail access
☐ Security services administration
☐ Network administration
☐ Infrastructure-as-Code administration

AWS Administrative Access

☐ Required
☐ Not Required

Production Access

☐ Required
☐ Not Required

9. Production Access

Determine whether the role can access production systems.

☐ No production access
☐ Read-only production access
☐ Limited production access
☐ Administrative production access
☐ Emergency production access

Assess whether the role can:

☐ View production data
☐ Modify production data
☐ Deploy code
☐ Restart services
☐ Change infrastructure
☐ Change security settings
☐ Access production databases
☐ Access production secrets

10. Source-Code Access

Determine whether the role can access:

☐ Public repositories
☐ Internal repositories
☐ Private source code
☐ Security-sensitive code
☐ Authentication code
☐ Infrastructure-as-Code
☐ CI/CD configuration
☐ Deployment credentials
☐ Code-signing mechanisms

Source-Code Risk

☐ Low
☐ Medium
☐ High

11. Security-System Access

Determine whether the role can administer:

☐ SIEM
☐ EDR
☐ Vulnerability management platform
☐ IAM platform
☐ Security monitoring
☐ Firewall
☐ WAF
☐ IDS/IPS
☐ DLP
☐ Backup/security systems
☐ Incident management platform
☐ Security configuration systems

Security Administration Required?

☐ Yes
☐ No

12. Credential and Secret Access

Determine whether the role can access:

☐ Passwords
☐ API keys
☐ Access tokens
☐ SSH keys
☐ Private keys
☐ Certificates
☐ Database credentials
☐ Cloud credentials
☐ Encryption keys
☐ Application secrets
☐ Recovery credentials

Secret Access Level

☐ None
☐ Limited
☐ Significant
☐ Administrative

13. Personal Data Access

Determine whether the role has access to:

☐ Employee personal data
☐ Customer personal data
☐ Applicant data
☐ Financial information
☐ Authentication information
☐ Health-related information where applicable
☐ Government identification information
☐ Other sensitive personal information

Personal Data Access

☐ None
☐ Limited
☐ Significant
☐ Administrative

14. Financial Access

Determine whether the role can access:

☐ Banking information
☐ Payment systems
☐ Accounting systems
☐ Payroll
☐ Financial reporting
☐ Customer payment information
☐ Refund/payment approval
☐ Financial transactions
☐ Procurement systems

Financial Authority

☐ None
☐ Transactional
☐ Approval
☐ Administrative

15. Business-Critical Process Assessment

Determine whether the role supports:

☐ Customer-facing services
☐ Revenue-generating systems
☐ Production operations
☐ Security operations
☐ Financial operations
☐ Regulatory processes
☐ Business continuity
☐ Disaster recovery
☐ Critical suppliers
☐ Customer support
☐ Core product/service delivery

Business Impact if Role Is Compromised

☐ Low
☐ Medium
☐ High
☐ Critical

16. Regulatory or Compliance Responsibility

Determine whether the role is responsible for:

☐ Regulatory reporting
☐ Compliance activities
☐ Privacy activities
☐ Security compliance
☐ Internal audit
☐ External audit coordination
☐ Financial compliance
☐ Customer contractual compliance
☐ Security certifications
☐ Risk management

Regulatory Impact

☐ Low
☐ Medium
☐ High
☐ Critical

17. Customer Trust Assessment

Determine whether the role can:

☐ Access customer systems
☐ Access customer data
☐ Support customer production environments
☐ Perform customer security testing
☐ Manage customer credentials
☐ Handle customer security incidents
☐ Access customer confidential information

Customer Impact

☐ Low
☐ Medium
☐ High
☐ Critical

18. Third-Party and Supplier Access

Determine whether the role manages:

☐ Supplier relationships
☐ Cloud providers
☐ Security providers
☐ Critical suppliers
☐ Subprocessors
☐ Customer-facing vendors
☐ Third-party privileged access

Supplier Impact

☐ Low
☐ Medium
☐ High

19. Remote and Physical Access

Determine whether the role has:

☐ Remote administrative access
☐ VPN access
☐ Remote production access
☐ Physical access to restricted areas
☐ Data-center access
☐ Server-room access
☐ Secure-office access
☐ Security equipment access

20. Separation of Duties Assessment

Determine whether the role combines incompatible responsibilities.

Examples:

☐ Request and approve access
☐ Develop and approve production deployment
☐ Create and approve financial transactions
☐ Develop and independently approve security controls
☐ Create and approve supplier payments
☐ Configure and independently validate security controls

Segregation-of-Duties Risk

☐ None
☐ Low
☐ Medium
☐ High

Compensating Control

21. Role Dependency Assessment

Determine whether the organization depends heavily on one person for:

☐ Critical system administration
☐ Security administration
☐ Cloud administration
☐ Database administration
☐ Source-code administration
☐ Security monitoring
☐ Incident response
☐ Disaster recovery
☐ Encryption/key management
☐ Critical business process

Key-Person Dependency

☐ No
☐ Yes

If yes:

22. Security Impact Assessment

Consider the impact if the role were compromised or misused.

Impact Area	Low	Medium	High	Critical
Confidentiality	☐	☐	☐	☐
Integrity	☐	☐	☐	☐
Availability	☐	☐	☐	☐
Privacy	☐	☐	☐	☐
Customer Trust	☐	☐	☐	☐
Regulatory	☐	☐	☐	☐
Financial	☐	☐	☐	☐
Business Continuity	☐	☐	☐	☐

23. Role Sensitivity Indicators

A role should receive additional review if one or more of the following apply:

☐ Privileged access
☐ Production access
☐ Restricted information access
☐ Customer data access
☐ Personal data access
☐ Financial authority
☐ Security administration
☐ Cloud administration
☐ Source-code administration
☐ Credential/secret access
☐ Critical business process responsibility
☐ Regulatory responsibility
☐ Customer-system access
☐ Physical restricted-area access
☐ Ability to disable security controls
☐ Ability to modify audit/logging records
☐ Significant supplier authority

24. Sensitive Role Decision

Role Sensitivity

☐ Standard
☐ Sensitive
☐ Highly Sensitive
☐ Privileged
☐ Critical

Rationale

The decision should be based on actual responsibilities, access, information, business impact, and applicable requirements rather than job title alone.

25. Background Screening Requirement

Based on the assessment:

☐ Basic screening
☐ Standard screening
☐ Enhanced screening
☐ High-risk screening
☐ Additional verification required
☐ No additional screening required

Screening Rationale

Any criminal, financial, regulatory, or similar checks should be performed only where lawful, relevant, and proportionate.

26. Access Control Requirements

For sensitive roles:

☐ Named account
☐ MFA
☐ Least privilege
☐ Role-based access
☐ Privileged access management where appropriate
☐ Just-in-time access where appropriate
☐ Temporary access
☐ Access expiry
☐ Session controls
☐ Logging
☐ Monitoring
☐ Periodic access review
☐ Immediate revocation capability

27. Additional Security Requirements

Where appropriate:

☐ Enhanced security awareness
☐ Role-specific security training
☐ Confidentiality agreement
☐ Additional management approval
☐ Additional monitoring
☐ Periodic re-screening
☐ Enhanced access review
☐ Dual approval
☐ Segregation of duties
☐ Incident escalation responsibility
☐ Business continuity assignment

28. Sensitive Role Approval

Role Owner: __________________________

Business Owner: ______________________

Information Security: __________________

HR/People: ___________________________

Risk Owner: __________________________

Approval Date: ________________________

Approval

☐ Approved as Standard
☐ Approved as Sensitive
☐ Approved as Highly Sensitive
☐ Approved as Privileged
☐ Further Assessment Required

29. Sensitive Role Register

Maintain a master list of identified sensitive roles.

Role ID	Role	Department	Sensitivity	Privileged	Production	Restricted Data	Screening Level	Owner	Review Date

30. Role Change Review

Reassess the role when:

☐ Responsibilities increase
☐ Production access is added
☐ Privileged access is added
☐ New sensitive information is introduced
☐ Customer access is introduced
☐ Financial authority is introduced
☐ Cloud administration is introduced
☐ Security responsibilities are added
☐ Regulatory responsibility changes
☐ Business criticality changes

Change Assessment

31. Periodic Review

Review sensitive roles periodically.

Check:

☐ Role description remains accurate
☐ Access remains necessary
☐ Information classification remains accurate
☐ Privileged access remains justified
☐ Screening requirements remain appropriate
☐ Segregation of duties remains effective
☐ Security responsibilities remain appropriate
☐ Business criticality remains accurate
☐ Compensating controls remain effective

Next Review Date: ______________________

32. Role Retirement

When a sensitive role is removed:

☐ Role removed from role register
☐ Access requirements reviewed
☐ User permissions reviewed
☐ Privileged permissions removed
☐ Production access removed
☐ Documentation updated
☐ Screening requirements archived appropriately
☐ Related risks reviewed
☐ Replacement role assessed

33. Findings

Record issues identified during role assessment.

Finding ID	Area	Finding	Risk	Action	Owner	Due Date	Status

34. Risk Treatment

For significant role-related risks:

Risk	Treatment	Control	Owner	Due Date	Residual Risk	Status

Possible treatments:

Reduce
Avoid
Share/Transfer
Accept

Risk acceptance should follow the organization’s defined risk-acceptance process.

35. AWS SaaS Startup Example

A SaaS startup identifies the following roles:

Role	Key Access	Sensitivity
Marketing Executive	Marketing systems	Standard
Developer	Source code, development	Sensitive
Senior Developer	Source code, CI/CD	Sensitive
DevOps Engineer	Cloud infrastructure, deployment	Highly Sensitive
AWS Administrator	IAM, production infrastructure	Privileged/Critical
DBA	Production database	Highly Sensitive
Security Engineer	Security tools, logs	Highly Sensitive
Finance Manager	Financial systems	Sensitive
VAPT Consultant	Security testing access	Highly Sensitive

For the AWS Administrator, the assessment may identify:

Production access
Privileged cloud access
IAM administration
Security configuration access
Potential access to restricted information
Ability to affect availability and integrity

The resulting controls may include:

Enhanced screening → Named account → MFA → Least privilege → Privileged-access controls → Logging → Periodic access review → Re-screening where applicable

36. Startup-Friendly Sensitive Role Model

A startup does not need a complicated classification system.

A practical model is:

Standard

Limited information and system access.

Sensitive

Access to confidential information or important systems.

Highly Sensitive

Access to restricted information, production systems, customer data, or security systems.

Privileged/Critical

Ability to administer infrastructure, security, identity, production, or other critical systems.

This classification can then drive:

Role → Screening → Access → Training → Monitoring → Review

37. Common Mistakes

Avoid:

Classifying roles based only on job title
Treating every IT role as equally sensitive
Ignoring contractors
Ignoring third-party personnel
Granting production access without reassessing role sensitivity
Ignoring source-code access
Ignoring cloud administration
Ignoring credential and secret access
Ignoring financial authority
Ignoring customer-system access
Failing to consider segregation of duties
Failing to reassess roles after responsibility changes
Applying intrusive screening without a lawful and documented basis
Storing unnecessary personal information
Granting privileged access before required approvals are completed

38. Relationship With Other ISMS Documents

Document	Relationship
Employee Screening Policy	Defines screening principles
Background Verification Procedure	Defines verification process
Background Verification Register	Records screening status
Role-Based Screening Matrix	Maps roles to screening levels
Employee Screening Checklist	Performs individual screening
Access Management Procedure	Controls role access
Privileged Access Procedure	Controls privileged access
Access Compliance Review Checklist	Reviews actual access
Personnel Security Procedure	Defines personnel-security requirements
Employee Onboarding Procedure	Applies controls during joining
Employee Offboarding Procedure	Removes access during exit
Risk Register	Records significant role-related risks

39. ISO/IEC 27001 Connection

Sensitive-role identification supports the organization’s risk-based approach to personnel security and access control.

The organization should determine, based on its ISMS scope and risks:

Which roles require additional security controls
Which roles require enhanced screening
Which roles require privileged-access controls
Which roles require additional training
Which roles require additional monitoring
Which roles require periodic review or re-screening

The Sensitive Role Identification Checklist is not itself a universally prescribed ISO/IEC 27001 document. The organization should determine its role classifications and controls based on risk, information sensitivity, access requirements, business impact, applicable controls, legal requirements, contractual requirements, and customer requirements.

40. Audit Evidence Checklist

Maintain appropriate evidence such as:

☐ Sensitive Role Identification Checklist
☐ Sensitive Role Register
☐ Role descriptions
☐ Role-Based Screening Matrix
☐ Background Verification Register
☐ Access approval
☐ Privileged access approval
☐ Access review records
☐ Training records
☐ Screening records
☐ Exception records
☐ Risk assessment
☐ Segregation-of-duties assessment
☐ Periodic role review
☐ Role change assessment

41. Final Sensitive Role Audit Trail

The organization should be able to demonstrate:

What roles exist?
Which roles are sensitive?
Why is the role considered sensitive?
What information can the role access?
What systems can the role access?
Does the role have privileged access?
Does it have production access?
Does it handle customer or personal data?
Does it have access to credentials or secrets?
What screening level applies?
What additional security controls apply?
Who approved the classification?
When was the role last reviewed?
What happens when the role changes?

Final Principle

A sensitive role should be identified based on what the person can access, what they can change, what information they can handle, and the potential business impact—not simply on their job title. Once a role is identified as sensitive, the classification should drive proportionate screening, access controls, security responsibilities, monitoring, and periodic review.