Users, Groups, & Roles, similar to Inventory and Partners, are optional but available in the system.
You
should be familiar with users and groups if you've ever worked with
Active Directory. They are the most important part of your
infrastructure as they allow you to assign permissions, apply GPO's, and
control information access and flow.
Active
Directory is well organized, but has poor reporting. So by matching
and working within NUDG, you will have a better idea of who has access
to what, assuming you stay up on it. Filling out this entire section is
a good starting point to satisfy many of the Access Control
Identifiers. Users may not be just employee's, they could be outside
contractors for example, if you need to reference them elsewhere in the
system for responsible parties, or roles.
GROUPS:
ROLES: (Notes below)
Roles
are unique in this instance as they do not have anything to do with
Active Directory. Roles (or Privileged Roles) are to help identify
special privileges a user or group may have. You may name these
anything you want, so long as you are consistent with what their purpose
is.
Take for example: Manager or Account
Manager could be a role. The purpose of this Role and the users
attached to it are they have approval to hire, terminate, request
permission changes, etc.
Network Administrator would be an
example of a role. Signifying who has special access to specific
resources, elevated permissions, and so forth.
Roles
can be basic as well (domain users, guests, local users), but they are
required to label and track to satisfy CMMC/NIST 800-171