{"id":93794,"date":"2026-10-24T16:16:41","date_gmt":"2026-10-24T09:16:41","guid":{"rendered":"https:\/\/itsystems.vn\/departmental-data-access-matrix-for-business\/"},"modified":"2026-10-24T16:18:52","modified_gmt":"2026-10-24T09:18:52","slug":"departmental-data-access-matrix-for-business","status":"publish","type":"post","link":"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/","title":{"rendered":"Departmental Data Access Matrix: A Practical Business Template"},"content":{"rendered":"<p><strong>Quick answer:<\/strong> A data-access matrix connects each <em>data area<\/em> to the <em>roles<\/em> that may read, edit, share, approve or administer it. It also names the business owner, approver and next review. Design it around roles and groups rather than manually assigning permissions to each employee. Department managers validate the business need; IT implements and tests; the company retains approval authority. The example below is a starting template, not a default policy for every organization.<\/p>\n<p>This article covers <strong>permission design before deployment or remediation<\/strong>. If you are still selecting a platform, read <a href='https:\/\/itsystems.vn\/en\/nas-file-server-or-sharepoint-for-business\/'>NAS, file server or SharePoint<\/a>. For survey-to-handover implementation, see <a href='https:\/\/itsystems.vn\/en\/business-it-system-design-deployment\/'>business IT system design and deployment<\/a>.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">The content of the article<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Why_department_names_alone_are_not_enough\" >Why department names alone are not enough<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#A_minimum_access_matrix_you_can_adapt\" >A minimum access matrix you can adapt<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Six_additional_fields_turn_the_sheet_into_an_operating_control\" >Six additional fields turn the sheet into an operating control<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#From_spreadsheet_to_effective_access_in_five_steps\" >From spreadsheet to effective access in five steps<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Translate_the_matrix_to_NAS_file_server_and_SharePoint_carefully\" >Translate the matrix to NAS, file server and SharePoint carefully<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Three_moments_that_require_an_immediate_review\" >Three moments that require an immediate review<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Frequently_asked_questions\" >Frequently asked questions<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/itsystems.vn\/en\/departmental-data-access-matrix-for-business\/#Technical_references\" >Technical references<\/a><\/li><\/ul><\/nav><\/div>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Why_department_names_alone_are_not_enough\"><\/span>Why department names alone are not enough<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Finance has staff who enter invoices, people who approve payments and managers who only need reports. HR records need narrower access than recruiting templates. Sales may need assigned customer accounts but not everyone else&#8217;s contracts or payroll. An employee may hold two roles or join a temporary project. If permissions arrive through chat requests and personal folder links, old access often remains after a transfer.<\/p>\n<p>Start with the business purpose of each data area. Name a content owner, access approver and technical operator. System-admin capability is not the same as authority to decide who should read a record. CISA recommends least privilege. Microsoft notes that Windows rights are easier to administer through groups, while SharePoint team-site permissions are commonly managed through the connected Microsoft 365 group or Teams.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"A_minimum_access_matrix_you_can_adapt\"><\/span>A minimum access matrix you can adapt<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>First divide data into areas with owners: personnel records, finance records, customer contracts, common operations and project material. In the table, R means read, E means edit\/create, A means business approval or content administration, and \u2014 means no access. External sharing should be a separate policy field, not assumed from edit rights. These rows are illustrative only.<\/p>\n<div style='width:100%;max-width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch'>\n<table style='min-width:820px;width:100%;table-layout:fixed;text-align:left'>\n<thead>\n<tr>\n<th style='text-align:left;vertical-align:top'>Example data area<\/th>\n<th style='text-align:left;vertical-align:top'>Owner \/ approver<\/th>\n<th style='text-align:left;vertical-align:top'>HR group<\/th>\n<th style='text-align:left;vertical-align:top'>Finance group<\/th>\n<th style='text-align:left;vertical-align:top'>Sales group<\/th>\n<th style='text-align:left;vertical-align:top'>IT operations<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style='text-align:left;vertical-align:top'>Personnel records<\/td>\n<td style='text-align:left;vertical-align:top'>HR lead<\/td>\n<td style='text-align:left;vertical-align:top'>R\/E; A by role<\/td>\n<td style='text-align:left;vertical-align:top'>\u2014 or restricted R by process<\/td>\n<td style='text-align:left;vertical-align:top'>\u2014<\/td>\n<td style='text-align:left;vertical-align:top'>Technical admin; content access by approval<\/td>\n<\/tr>\n<tr>\n<td style='text-align:left;vertical-align:top'>Finance records<\/td>\n<td style='text-align:left;vertical-align:top'>Finance lead<\/td>\n<td style='text-align:left;vertical-align:top'>\u2014<\/td>\n<td style='text-align:left;vertical-align:top'>R\/E; A by role<\/td>\n<td style='text-align:left;vertical-align:top'>\u2014<\/td>\n<td style='text-align:left;vertical-align:top'>Technical admin; content access by approval<\/td>\n<\/tr>\n<tr>\n<td style='text-align:left;vertical-align:top'>Customer contracts<\/td>\n<td style='text-align:left;vertical-align:top'>Sales lead<\/td>\n<td style='text-align:left;vertical-align:top'>\u2014<\/td>\n<td style='text-align:left;vertical-align:top'>Approved limited R<\/td>\n<td style='text-align:left;vertical-align:top'>R\/E for assigned team<\/td>\n<td style='text-align:left;vertical-align:top'>Technical admin; content access by approval<\/td>\n<\/tr>\n<tr>\n<td style='text-align:left;vertical-align:top'>Common operations<\/td>\n<td style='text-align:left;vertical-align:top'>Operations lead<\/td>\n<td style='text-align:left;vertical-align:top'>R<\/td>\n<td style='text-align:left;vertical-align:top'>R<\/td>\n<td style='text-align:left;vertical-align:top'>R<\/td>\n<td style='text-align:left;vertical-align:top'>R\/E only for assigned IT material<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p><strong>Do not apply this example unchanged to production data.<\/strong> Owners must decide rights from actual duties, sensitivity and the organization&#8217;s legal processes. &#8216;Restricted R&#8217; must name the exact folder, report or record scope. Application-level record permissions cannot be replaced by a folder matrix.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Six_additional_fields_turn_the_sheet_into_an_operating_control\"><\/span>Six additional fields turn the sheet into an operating control<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>1. Data area and location:<\/strong> business name, NAS or file-server path, SharePoint site\/library, related application and authoritative copy. Avoid several locations all claiming to be the master record.<\/p>\n<p><strong>2. Owner and approver:<\/strong> content accountability belongs to a business role, which may differ from the IT administrator. Record a delegate and require reason and end date for unusual access.<\/p>\n<p><strong>3. Group and role:<\/strong> use consistent group names, role descriptions and group owners. Direct user grants are harder to audit. Microsoft recommends group-based Windows administration; the connected group normally governs a modern SharePoint team site.<\/p>\n<p><strong>4. Permission level:<\/strong> separate read, edit, delete, external share, approve and administer. &#8216;Edit&#8217; can permit more actions than a manager expects on a given platform, so test the effective level.<\/p>\n<p><strong>5. Effective dates and exceptions:<\/strong> include temporary project members, guests, end dates and renewal. A public link or shared account is not a replacement for an approved exception.<\/p>\n<p><strong>6. Evidence and review date:<\/strong> retain the ticket or approval, implementer, test result and next review. Review immediately after a role change or departure, even if the periodic review is not due.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"From_spreadsheet_to_effective_access_in_five_steps\"><\/span>From spreadsheet to effective access in five steps<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Step 1 &#8211; Inventory:<\/strong> list repositories, owners, privileged accounts, existing groups, external guests and orphaned data. Export the current state and define a rollback before mass changes.<\/p>\n<p><strong>Step 2 &#8211; Approve:<\/strong> business owners and managers sign off on access by area. HR supplies roles, effective dates and movements. IT highlights technical conflicts and applications that depend on an existing permission path.<\/p>\n<p><strong>Step 3 &#8211; Map to groups:<\/strong> turn business roles into technical groups. On Windows file servers inspect both share and NTFS permissions; on a NAS inspect its group and ACL model; in SharePoint inspect site, library, Owners\/Members\/Visitors and sharing links. Limit one-off file exceptions.<\/p>\n<p><strong>Step 4 &#8211; Pilot:<\/strong> test representative accounts, including one without access and a suitable former-role test account. Check read, edit, delete, sync, external sharing and applications that open the files. An administrator-only test is insufficient.<\/p>\n<p><strong>Step 5 &#8211; Accept and operate:<\/strong> log results and remaining exceptions, obtain owner sign-off and document access requests\/revocation. Tie the matrix to the <a href='https:\/\/itsystems.vn\/en\/it-support-checklist-employee-onboarding-offboarding\/'>joiner and leaver checklist<\/a> so actual access stays aligned with the approved design.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Translate_the_matrix_to_NAS_file_server_and_SharePoint_carefully\"><\/span>Translate the matrix to NAS, file server and SharePoint carefully<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>On a NAS or file server, parent folders and inheritance can drive effective access. Windows has both share and NTFS permissions to consider. Group overlap can change the effective result, so test real accounts. SharePoint team sites connect to Microsoft 365 groups; Owners, Members and Visitors carry different rights. Microsoft recommends managing connected team-site access through the group or Teams, with Visitors for view-only scenarios where needed. Record exceptions at library, folder or file level so they do not become invisible.<\/p>\n<p>An access matrix is not a complete data-protection program. Backups, retention, MFA, device control and change logs address other risks. IT may need platform privileges to operate the environment, but that should not be interpreted as standing business approval to read all HR or financial content.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Three_moments_that_require_an_immediate_review\"><\/span>Three moments that require an immediate review<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Employee transfers:<\/strong> remove old groups before or alongside newly approved access. Check direct grants, sharing links and temporary projects rather than only changing the HR job title.<\/p>\n<p><strong>Contractor agreement ends:<\/strong> confirm handover, disable guest access, remove links and check any remaining device or key access. Keep a ticket and completion timestamp.<\/p>\n<p><strong>Project closes:<\/strong> name the final document set and long-term owner, decide who retains read access, and remove edit or broad-share rights. Do not delete records without the organization&#8217;s retention approval.<\/p>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><strong>Does a small company need a matrix?<\/strong> Yes, but it can begin with a few important data areas and four to six roles. A short table with owners and approvers is better than unmanaged individual grants.<\/p>\n<p><strong>Can IT approve its own access requests?<\/strong> IT can implement and advise, but the data owner or delegated business approver should authorize the purpose. Emergency administrator access needs its own controlled process and log.<\/p>\n<p><strong>How often should access be reviewed?<\/strong> The schedule depends on risk and staff turnover. Review immediately after role changes or departures and periodically against an agreed plan; sensitive areas may need closer review.<\/p>\n<p><strong>Does the matrix replace backup or DLP?<\/strong> No. It limits and explains access; recovery and data-loss controls address additional failure modes.<\/p>\n<aside style='background:#eaf7f6;padding:20px;border-left:4px solid #167d78'><strong>Need to redesign business data access before deployment?<\/strong><\/p>\n<p>IT Systems can work with data owners to inventory groups, design the matrix, pilot permissions across NAS, file servers or Microsoft 365, test access and hand over operating records within an agreed project scope.<\/p>\n<p><a href='https:\/\/itsystems.vn\/en\/business-it-system-design-deployment\/#formlead'>Request an IT system assessment<\/a> \u00b7 <a href='tel:02839950359'>Call +84 28 3995 0359<\/a><\/p>\n<\/aside>\n<h2 style='text-align:left'><span class=\"ez-toc-section\" id=\"Technical_references\"><\/span>Technical references<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/security\/identity-protection\/access-control\/access-control\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: Windows access control<\/a>; <a href=\"https:\/\/learn.microsoft.com\/en-us\/sharepoint\/modern-experience-sharing-permissions\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: modern SharePoint permissions<\/a>; <a href=\"https:\/\/learn.microsoft.com\/en-us\/sharepoint\/understanding-permission-levels\" target=\"_blank\" rel=\"noopener\">Microsoft Learn: SharePoint permission levels<\/a>; <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/CISA%20Insights_Guidance-for-MSPs-and-Small-and-Mid-sized-Businesses_S508C.pdf\" target=\"_blank\" rel=\"noopener\">CISA: least privilege and SMB guidance<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Build a departmental data-access matrix with business owners, approvers, role groups, test cases and a review cycle for NAS, file servers and SharePoint.<\/p>\n","protected":false},"author":68,"featured_media":93792,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"rank_math_focus_keyword":"data access matrix","rank_math_title":"Departmental Data Access Matrix: A Practical Business Template | IT Systems","rank_math_description":"Build a departmental data-access matrix with business owners, approvers, role groups, test cases and a review cycle for NAS, file servers and SharePoint.","rank_math_robots":"","rank_math_canonical_url":"","rank_math_schema":"","footnotes":""},"categories":[2143],"tags":[],"class_list":["post-93794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-service"],"wpml_current_locale":"en_US","wpml_translations":{"vi_VN":{"locale":"vi_VN","id":93793,"slug":"ma-tran-phan-quyen-du-lieu-theo-phong-ban","post_title":"Ma tr\u1eadn ph\u00e2n quy\u1ec1n d\u1eef li\u1ec7u theo ph\u00f2ng ban: m\u1eabu cho doanh nghi\u1ec7p","href":"https:\/\/itsystems.vn\/ma-tran-phan-quyen-du-lieu-theo-phong-ban\/"}},"_links":{"self":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts\/93794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/comments?post=93794"}],"version-history":[{"count":1,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts\/93794\/revisions"}],"predecessor-version":[{"id":93796,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/posts\/93794\/revisions\/93796"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/media\/93792"}],"wp:attachment":[{"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/media?parent=93794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/categories?post=93794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/itsystems.vn\/en\/wp-json\/wp\/v2\/tags?post=93794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}