Skip to content

OpenAI access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On OpenAI, Black Cat runs 19 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the OpenAI connector needs.

Checks (19)

severity: high Stale API Key fix difficulty: easy #

Delete stale OpenAI API keys that have not been used recently

  1. Log in to the OpenAI platform and navigate to API Keys
  2. Identify API keys that have not been used recently
  3. Verify with teams that the key is no longer needed
  4. Delete the stale API key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium API Key Non-User Owner fix difficulty: easy #

Review OpenAI API keys owned by service accounts and ensure each has a documented purpose

  1. Navigate to API Keys
  2. Filter by owner type
  3. Review service account owned keys
  4. Verify each key has documented purpose
  5. Ensure service account keys follow naming convention

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Admin Key Sprawl fix difficulty: medium #

Consolidate OpenAI admin API keys to the minimum required and delete unnecessary ones

  1. Log in to the OpenAI platform and navigate to Organization Settings
  2. Review all admin-level API keys
  3. Consolidate admin keys to the minimum required
  4. Delete unnecessary admin keys

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Stale Admin Key fix difficulty: easy #

Delete stale OpenAI admin API keys that have not been used recently

  1. Log in to the OpenAI platform and navigate to Organization Settings
  2. Identify admin keys that have not been used recently
  3. Confirm the key is no longer needed with the key owner
  4. Delete the stale admin key

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Admin Key Non-User Owner fix difficulty: medium #

Reassign OpenAI admin API keys owned by service accounts to user accounts for accountability

  1. Navigate to Admin API Keys
  2. Identify key owned by non-user entity
  3. Determine if service account ownership is intentional
  4. Recreate key under user account if needed for accountability

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Organization Owners fix difficulty: easy #

Reduce OpenAI organization owners to 2-3 by demoting unnecessary owners to lower roles

  1. Log in to the OpenAI platform and navigate to Organization Settings > Members
  2. Review users with the Owner role
  3. Demote unnecessary owners to the Member or Reader role
  4. Keep only 2-3 organization owners

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-01 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Owner Redundancy Missing fix difficulty: easy #

Promote a second trusted member to Owner in the OpenAI organization for redundancy

  1. Navigate to Settings > Members
  2. Identify single owner
  3. Promote trusted member to owner role
  4. Verify new owner has MFA enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1c HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Disabled User Not Removed fix difficulty: easy #

Remove disabled OpenAI users from the organization after confirming no active API keys remain

  1. Navigate to Settings > Members
  2. Find disabled user
  3. Confirm no active API keys for user
  4. Remove user from organization

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a3 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Excessive Service Accounts fix difficulty: medium #

Delete unnecessary OpenAI service accounts from projects with excessive service account counts

  1. Log in to the OpenAI platform and navigate to Projects
  2. Select the project with excessive service accounts
  3. Review each service account and its purpose
  4. Delete service accounts that are no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Project API Keys fix difficulty: medium #

Revoke unused or duplicate OpenAI project API keys to reduce key sprawl

  1. Navigate to API Keys
  2. Filter by project
  3. Identify unused or duplicate keys
  4. Revoke keys no longer in use
  5. Document remaining keys and their purposes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Project With Only Service Accounts fix difficulty: easy #

Assign at least one human user as administrator to OpenAI projects owned only by service accounts

  1. Navigate to Settings > Projects
  2. Select the project
  3. Review service accounts
  4. Assign at least one human user as project administrator for oversight
  5. Document automation purpose

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Orphaned Service Account fix difficulty: easy #

Delete OpenAI service accounts that are no longer associated with an active project

  1. Log in to the OpenAI platform and navigate to Projects
  2. Identify service accounts not associated with an active project or owner
  3. Verify the service account is no longer in use
  4. Delete the orphaned service account

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Stale Service Account fix difficulty: medium #

Rotate credentials or delete stale OpenAI service accounts that have not been active recently

  1. Navigate to Settings > Projects
  2. Select the project
  3. Review service accounts
  4. Identify the stale service account
  5. Rotate credentials or delete if unused

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Empty Group fix difficulty: easy #

Remove OpenAI groups that have no members

  1. Log in to the OpenAI platform and navigate to Organization Settings > Groups
  2. Review the group with no members
  3. Add members if the group is needed, or delete it

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Group Not SCIM-Managed fix difficulty: medium #

Bring manually managed OpenAI groups under SCIM management to reduce drift

  1. Configure SCIM provisioning with your identity provider
  2. Migrate the manually managed group to SCIM management
  3. Verify membership syncs from the identity provider

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.3 CIS Controls v8 CIS-05.1 NIST CSF 2.0 PR.AA-02 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Expired Invite fix difficulty: easy #

Remove expired OpenAI invites that are still present

  1. Log in to the OpenAI platform and navigate to Organization Settings > Members
  2. Review the pending and expired invites
  3. Revoke or delete the expired invite

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Invite Grants Owner Role fix difficulty: easy #

Verify pending OpenAI invites that grant the owner role are intentional

  1. Log in to the OpenAI platform and navigate to Organization Settings > Members
  2. Review the pending invite that grants the owner role
  3. If unintended, revoke the invite and re-invite with a lower role

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.2 SOC 2 Type II CC6.2 CIS Controls v8 CIS-05.4 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Stale Pending Invite fix difficulty: easy #

Resend or revoke OpenAI invites that have been pending too long

  1. Log in to the OpenAI platform and navigate to Organization Settings > Members
  2. Review invites pending beyond 30 days
  3. Resend the invite or revoke it if no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Overpermissive Custom Role fix difficulty: medium #

Reduce permissions on overpermissive OpenAI custom roles to follow least privilege

  1. Log in to the OpenAI platform and navigate to Organization Settings > Roles
  2. Review the custom role's permissions
  3. Remove unnecessary permissions and split write/admin grants where possible

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More OpenAI checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial