Custom objects that store business data must have access rights enabled

Control Statement: Every custom object that stores business data must be administered by operations, by records, or by columns.

Description: Creatio evaluates access rights only on objects that are marked as administered. An object with none of “Administered by operations”, “Administered by records” or “Administered by columns” enabled is not subject to access-rights evaluation at all: any user who can reach it may read, create, edit and delete every record it holds. This control requires that every custom object holding business data have at least one form of administration enabled.

Objects that hold no data of their own — link tables and detail joins carrying only foreign keys — are out of scope. The requirement attaches to objects that store business data.

Rationale: This is the most consequential default in the Creatio permission model, because its failure mode is silent. An unadministered object does not deny access and log it; it never evaluates access in the first place. No permission screen will show anything wrong, because there are no permissions to show. An object created to hold contract values, salary bands or medical notes is, until administration is enabled, readable and deletable by every licensed user who can reach its section — and nothing in the interface indicates it.

Audit Procedure:

1. Enumerate the custom objects in the configuration that store business data — those carrying columns of their own beyond foreign keys and system columns.
2. For each, open the object in the Object Designer and inspect its administration settings.
3. Record the object as non-compliant if “Administered by operations”, “Administered by records” and “Administered by columns” are all disabled.
4. Confirm that objects excluded as link or detail tables genuinely hold no business data of their own.

Remediation:

1. For each non-compliant object, determine the appropriate level of administration: by operations where access depends on role, by records where it depends on record ownership, by columns where individual fields carry differing sensitivity.
2. Enable the corresponding administration setting on the object.
3. Grant access to the roles that require it before publishing, so enabling administration does not interrupt legitimate use.
4. Record the decision in the system of record required by CSB-FDNS-001.

Default Value: Creatio creates new objects with all three administration settings disabled. A newly created object is therefore not access-controlled until an administrator explicitly enables administration on it.