Entity Based Access vs Confidentiality

[Community Alums]

Hello GRC experts,

I haven't got a chance to hands on GRC: Entity Based Access. If anyone did, can you please share:

1. If we enable Entity Based Access, will it override existing configuration at Confidentiality?

2. When should we use Entity Based Access or Confidentiality?

3. Can we use both and any precedence or on how system treat the priority?

4. Any important points we should know or consider when using both or any of the enablement?

Advanced thanks!

RM.

[SrinivasMeV · Accepted solution]

Hi @Community Alums  Please find responses below 

1. If we enable Entity Based Access, will it override existing configuration at Confidentiality?

No, entity-based access will not override the confidentiality feature. Confidentiality takes precedence over entity-based access. This means that even if a user is not part of the entity-based access configuration, they will still be able to access a confidential record as long as they have the necessary ACL/Role access to the record.

2. When should we use Entity Based Access or Confidentiality?

Confidentiality is a record-level access control that allows users to access a confidential record only if they are designated as confidential users for that record.

Entity-based access controls groups of records related to an entity. Users in the entity-based access configuration can access all related risks, controls, issues, etc., for that entity.

3. Can we use both and any precedence or on how system treat the priority?

Yes, both confidentiality and entity based access can be used at the same time. Confidentiality takes precedence over Entity based access. So even after entity based access is enabled and configured, it will not affect the confidential records and confidential users who will continue to access the records in the same way as they are using now.

4. Any important points we should know or consider when using both or any of the enablement?

While using both, confidentiality takes precedence over entity based access. Entity based access will have few exclusions such as record opened by user / created by user who will continue to access the record created by the user even if they are not part of configuration. This will enable employees to access the record reported from the employee center to follow up on the status. More detailed documentation will be provided during the release.

[Community Alums]

I really appreciate this, Srivinas! Thank you so much!