Josh Grossman

This seems like a classic architecture level control where the conceptual basis is included in 1.4.x but the practical requirements are included in 4.x. Do you disagree @elarlang ?

I think that 1.4.5 is not something you explicitly need to check in the code but rather describing a specific AuthZ paradigm so I think it is fine. What do...

I agree there should also be a specific requirement in 4.x

1.4.5, checking access control based on roles rather than permission attributes makes it more difficult to remove permissions from a role as the access control checking code is hardcoded to...

@elarlang any further comments?

@Sjord can you tell if the current requirement is ported from NIST?

In principle, I would prefer to be aligned with NIST in this case. For companies that violate the timeouts, I can think of three ways to handle this: 1) We...

> In principle, I would prefer to be aligned with NIST in this case. > > For companies that violate the timeouts, I can think of three ways to handle...

@jmanico are you able to draft the suggested text?

Seemed to be support for CSP staying as Level 1 in #1297 so I closed that but I think we still need to decide how we want it to read...