17. What security and permission tests should we run on a GRC platform?

Test access through every route by which sensitive information can leave the platform—not only through ordinary record screens. IBM’s OpenPages 9.1.x export documentation explicitly warns that its privileged Data Export permission can export data regardless of ordinary role-based security and related controls; that is a privileged feature requiring governance, not proof of a general product vulnerability. Export documentation. (ibm.com)

Our proposed test matrix covers:

• Business-unit and legal-entity segregation.
• Restricted findings and individual evidence files.
• Search results, previews and autocomplete.
• Dashboards, scheduled reports and email notifications.
• API identities and bulk exports.
• AI retrieval and generated summaries.
• Support access, privileged administration and emergency access.
• Access removal after role changes or departure.

Use synthetic restricted material with distinctive identifiers. Attempt retrieval as an ordinary contributor, a reviewer from another unit, an administrator and an integration identity. Record both legitimate access and expected denial.

Request the supplier’s security evidence for the actual service and deployment under consideration. Ask about subprocessors, support locations, incident handling, backup access, restoration and deletion.

Minimum proposed gate: no unresolved unauthorised disclosure in the tested scenarios, and a documented approval and monitoring process for legitimate privileged access. Passing those scenarios is not proof that every possible access path is safe.