CVE-2023-40516

A.5.1 only requires the existence of an overarching policy and topic-specific policies (including on access control); it does not itself enforce, implement, or act on permissions and therefore cannot stop CWE-732 from being exploitable.

A.5.12 only defines and communicates a classification scheme (with owners accountable for applying it); it does not itself enforce, restrict or decide any permissions, so the CWE-732 permission flaw can still be present and exploitable.

A.5.15 directly requires determining access needs, defining and communicating an access control policy, implementing rules that map rights/restrictions to entities (including consistency with classification), and considering need-to-know, privileged restrictions, segregation, formal authorization, and dynamic factors — which squarely stops most incorrect permission assignments from being exploitable; the bounded remainder is misconfigurations that violate the policy itself.

A.5.18 directly governs the provisioning, review, adjustment and revocation of logical access rights (including for critical resources) according to business needs, policy, SoD and risk, which stops most unintended actors from reading/modifying via incorrect permissions; the bounded remainder is incorrect permission assignments that are not access-right decisions at all (e.g. filesystem umask, ACL syntax errors).

Documented responsibility for protecting assets encourages correct permission settings rather than leaving them at insecure defaults.

Monitoring supplier policy changes and conducting audits can reveal incorrect permission assignments on resources managed by the supplier, prompting corrective action before they are exploited.