Mitigate user or mitigate roles

[Former Member]

If there is a mitigating control in the system and I want to tie it to certain users for a specific amount of time is it best to mitigate the user's or the role that the user's are tied to instead?

[Former Member]

Hi Valarie,

It depends on what you need to achieve. If you want to mitigate this particular risk for a particular user then you should mitigate the user (it seems this is what you are looking for). If you mitigate a role for a particular risk. In this case, this role will be mitigated for all the users which have this role assigned to their user id.

Regards,

Alpesh