Least privilege

Access tends to accumulate: granted for one project, never withdrawn, inherited by whoever takes the role next. After two years the average small company has several people holding administrative rights nobody would grant them today, and no record of when or why.

The practical form is boring and works. Roles rather than individuals; the narrowest role that completes the task; a quarterly review that lists who holds administrative access to each system and requires a named person to justify each one; and a fixed expiry on anything granted for a specific piece of work. A contractor's access should end on the date the contract does, set at the moment it is granted rather than remembered afterwards.

Administrator by default because it is faster

Granting full rights to avoid a permissions conversation is the origin of nearly every access problem that surfaces later. It also removes the audit trail that would have shown what happened, because when everyone can do everything, nothing is attributable.

Somebody will quote this number at you.

Knowing the definition is not the same as being able to check the figure. These are the procedures that do the second thing.

Testing a claim that you are covered

“We have backups. Everything is backed up nightly.” · 40 minutes, 6 questions.

Somebody is accountable for this number.

A definition is free. Being answerable for the figure it produces is the part that is bought, and this term is a working part of the engagements below.

IT consulting for companies in Dubai and across the Emirates

A company owns what it can recover without asking anyone's permission. The rest is rented.

---

Custom software development and AI engineering for Dubai

A probabilistic component is only safe inside a deterministic boundary.

Offboarding

The sequence that removes a departing person's access to everything, in an order that does not lock the company out of its own systems on the way.

---

Named accounts and shared credentials

Access issued to a person rather than to a login everyone uses — the difference between being able to revoke one person and having to change everything.

---

Key-person risk

The number of people whose sudden absence would stop something important — and in most small companies the answer for the digital estate is one.

All ninety-six termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.