Free preview: Access Control Policy

Policy Statement and Principles

Access to [Company Name] systems and data must be controlled according to the following principles. These principles apply to every access decision and take precedence over convenience or speed of provisioning.

• Deny by default: no access exists until it is explicitly requested, approved, and provisioned.
• Least privilege: each account receives the minimum permissions required for the holder's current job duties, as informed by the Risk Assessment and Treatment Procedure.
• Need to know: access to information classified as Confidential or Restricted under the Asset Management and Information Classification Policy requires a documented business need.
• Individual accountability: every account must be attributable to a single named person or a documented service purpose; credential sharing is prohibited.
• Segregation of duties: where practical, the person who requests access must not be the same person who approves it, and approvers must not approve their own access.
• Auditability: all grants, changes, and revocations must be recorded in [System name, e.g. IT ticketing system] and retained for at least [3] years.

Roles and Responsibilities

Broader security duties are defined in Information Security Roles and Responsibilities. The access-specific duties are summarized below.

Account Lifecycle Management

Every account follows a defined lifecycle: request, approval, provisioning, periodic review, modification on role change, and revocation on departure. The [Role, e.g. IT Administrator] must maintain a current inventory of all systems holding company data and the accounts on each, reconciled against the asset inventory in the Asset Management and Information Classification Policy at least quarterly. The joiner, mover, and leaver workflows below are mandatory and must be evidenced by tickets or checklists in [System name].

Joiners: Granting Access