Workday access control & privilege security checks
Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.
On Workday, Black Cat runs 3 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Workday connector needs.
Checks (3)
severity: medium Security Group With Excessive Members fix difficulty: medium #
Review and reduce security group membership
- Navigate to Workday > Security > Security Groups
- Review the group's membership list
- Remove users who no longer need access
- Consider splitting into more targeted groups
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: low Empty Security Group fix difficulty: easy #
Remove unused security group or add members
- Verify the group is not used by any security policy
- If unused, delete the security group
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2
severity: high Security Group With Broad Domain Access fix difficulty: medium #
Reduce domain permissions for this security group
- Review the domain security policies granted to this group
- Remove permissions not required for the group's function
- Apply the principle of least privilege
Satisfies: ISO 27001:2022 A.5.18 SOC 2 Type II CC6.3 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2