classes of user
A grouping mechanism used in access-control policy and governance by which individual accounts or principals are aggregated into named categories that share a common privilege profile, trust level, or functional responsibility. Unlike a single role tied to one job function, a "class of users" operates at a higher level of abstraction — it may encompass multiple roles, account types (e.g., privileged, non-privileged, service accounts), or populations (e.g., internal users, contractors, administrators) that warrant the same set of access rights and the same oversight treatment. In practice, standards such as NIST SP 800-53 require organizations to periodically review "the privileges assigned to roles or classes of users to validate the need for such privileges," recognizing that privilege requirements change over time with shifts in mission, technology, or threat. NIST SP 800-171A similarly operationalizes the concept by requiring that organizations define the frequency at which privileges assigned to roles or classes of users are reviewed, and then actually perform that review to validate continued need.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A grouping mechanism used in access-control policy and governance by which individual accounts or principals are aggregated into named categories that share a common privilege profile, trust level, or functional responsibility. Unlike a single role tied to one job function, a "class of users" operates at a higher level of abstraction — it may encompass multiple roles, account types (e.g., privileged, non-privileged, service accounts), or populations (e.g., internal users, contractors, administrators) that warrant the same set of access rights and the same oversight treatment. In practice, standards such as NIST SP 800-53 require organizations to periodically review "the privileges assigned to roles or classes of users to validate the need for such privileges," recognizing that privilege requirements change over time with shifts in mission, technology, or threat. NIST SP 800-171A similarly operationalizes the concept by requiring that organizations define the frequency at which privileges assigned to roles or classes of users are reviewed, and then actually perform that review to validate continued need.DR-088 backfill from the noun definition column