Access Control Policy

Access Control Policy
Document Ref CYB-DOC-03-1

Version 1
Dated [Insert date]
Document Author [Insert name]
Document Owner [Insert name/role]
Revision History
VERSION DATE REVISION AUTHOR SUMMARY OF CHANGES
Distribution
NAME TITLE
Approval
NAME POSITION SIGNATURE DATE
Version 1 Page 2 of 8 [Insert date]

Contents
1 Introduction ..............................................................................................................8
2 Access Control Principles ...........................................................................................9
3 User Access Management........................................................................................10
3.1 User Registration And Deregistration ......................................................................... 10
3.2 User Access Provisioning ............................................................................................ 10
3.3 Removal Or Adjustment Of Access Rights ................................................................... 11
3.4 Management Of Privileged Access Rights .................................................................... 11
3.5 Supplier Remote Access To The Organisation Network................................................ 11
3.6 Review Of User Access Rights ..................................................................................... 12

1 Introduction
The control of access to our information is a fundamental part of information security. If we
are to effectively protect sensitive data, we must ensure that a comprehensive mix of
physical and technical controls are in place.
But our policy for access control must ensure that the measures we implement are
appropriate to the business requirement for protection and are not unnecessarily strict. The
policy therefore must be based upon a clear understanding of the business requirements of
the owners of the information we are trying to protect.
These requirements may depend on factors such as:
• The sensitivity of the information stored and processed by a particular system

• Relevant legislation that may apply, such as the GDPR
• The regulatory framework the organisation is subject to
• Contractual obligations to external third parties
• The threats and risks involved
• How much risk is acceptable
This access control policy is designed to take account of the business and information
security requirements of the organisation and is subject to regular review to ensure that it
remains appropriate.
This control applies to all systems, people and processes that constitute the organisation’s
information systems, including board members, directors, employees, suppliers and other
third parties who have access to [Organization Name] systems.
The following policies and procedures are relevant to this document:
• Mobile Device Policy

• Network Security Policy
• Cloud Computing Policy

2 Access Control Principles

A number of general principles will be used when designing access controls for
[Organization Name] systems and services.
These are:
• Defence in Depth – security must not depend upon any single control but be the sum
of a number of protective measures, for example multiple doors
• Least Privilege – the default approach taken must be to assume that access is not
required, rather than to assume that it is
• Need to Know – access is only granted to the information required to perform a role,
and no more
Adopting these basic principles will help to keep systems secure by reducing risk and
therefore the number and severity of cyber security incidents that occur.
As part of the selection of cloud service providers specifically, bear in mind the following
access-related considerations:
• How user accounts are created, maintained and deleted

• How access rights to the cloud service are managed
• Availability of multi-factor authentication for administrator accounts
• Procedures for the allocation of secret information, such as passwords
Addressing these requirements as part of the selection process will ensure that the
provisions of this policy can be met in the cloud as well as within internal systems.

3 User Access Management

User access control procedures must cover all stages of the lifecycle of a user, from the
initial registration of new users to the final de-registration of users who no longer require
access.
User access rights must be reviewed at regular intervals to ensure the correct rights are still
allocated. System administration accounts must only be provided to users who are required
to perform system administration tasks.
3.1 User Registration and Deregistration

A request for access to the organisation’s network and computer systems must first be
submitted to the [IT Service Desk] for approval. Appropriate security checks must be carried
out and correct authorisation is obtained prior to creating a user account.
Each user account will have a unique username which is not shared with any other user and
is associated with a specific individual – i.e. not a role or job title. Generic user accounts –
single accounts to be used by a group of people – must not be created as they provide
insufficient allocation of responsibility.
An initial strong password must be created on account setup and communicated to the user
via a separate and secure method. The user must be required to change the password on
first use of the account.
When an employee leaves the organisation under normal circumstances, their access to
computer systems must be suspended at the close of business on their last working day. It is
the responsibility of the line manager to request the suspension of the access rights via the
[IT Service Desk].
In exceptional circumstances where there is perceived to be a risk that the employee may
take action that may harm the organisation prior to or upon termination, a request to
remove access may be approved and actioned in advance of notice of termination being
given. This precaution will especially apply in the case where the individual concerned has
privileged access rights, such as administrator.
User accounts must be initially suspended or disabled only and not deleted. User account
names must not be reused as this may cause confusion in the event of a later investigation.
3.2 User Access Provisioning

Each user must be allocated access rights and permissions to computer systems and data
which correspond with the tasks they are expected to perform. In general, this will be role-

based, i.e. a user account will be added to a group which has been created with the access
permissions required by that job role.
Group roles must be maintained in line with business requirements and any changes to
them must be formally authorised.
Ad-hoc additional permissions must not be granted to user accounts outside the group role.
If such permissions are required, this must be formally requested.
3.3 Removal or Adjustment of Access Rights

Where an adjustment of access rights or permissions is required, e.g. due to an individual
changing role, this must be carried out as part of the role change. It must be ensured that
access rights no longer required as part of the new role are removed from the user account.
If a user is taking on a new role in addition to their existing one (rather than instead of) then
a new composite role must be requested.
Under no circumstances will administrators be permitted to change their own user accounts
or permissions.
3.4 Management of Privileged Access Rights

Privileged access rights such as those associated with administrator-level accounts must be
identified for each system or network and tightly controlled. In general, technical users
(such as IT support staff) will not make day-to-day use of user accounts with privileged
access. Instead, a separate “admin” user account must be created and used only when the
additional privileges are required. These accounts must be specific to an individual, e.g.
“John Smith Admin”. Generic admin accounts must not be used as they provide insufficient
identification of the user.
Access to admin level permissions must only be allocated to individuals whose roles require
them and who have received sufficient training to understand the implications of their use.
The use of user accounts with privileged access in automated routines or programs such as
batch or interface jobs must be avoided where possible. Where this is unavoidable, the
password used must be protected.
3.5 Supplier Remote Access to The Organisation Network

Partner agencies or third-party suppliers must not be given details of how to access the
organisation’s network without permission from the [IT Service Desk]. Any changes to a

supplier’s connections (e.g. on termination of a contract) must be immediately sent to the

[IT Service Desk] so that access can be updated or ceased.
Partners or third-party suppliers must contact the [IT Service Desk] on each occasion to
request permission to connect to the network, and a log of activity must be maintained.
Remote access software and user accounts must be disabled when not in use.
3.6 Review Of User Access Rights

On a regular basis (at least annually) system owners will be required to review who has
access to their areas of responsibility and the level of access in place. This will be to identify:
• People who should not have access (e.g. leavers)

• User accounts with more access than required by the role
• User accounts with the wrong role allocation
• Generic or shared accounts
• Any other issues that do not comply with this policy
This review will be performed according to a formal procedure and any corrective actions
identified and carried out.
A review of user accounts with privileged access will be carried out by the [Information
Security Manager] on a quarterly basis to ensure that this policy is being complied with.

Access Control Policy

Uploaded by

Copyright:

Available Formats

Access Control Policy

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Access Control Policy

Uploaded by

Copyright:

Available Formats

Access Control Policy

Document Ref CYB-DOC-03-1

Version 1 Page 2 of 8 [Insert date]

Version 1 Page 3 of 8 [Insert date]

These requirements may depend on factors such as:

• The sensitivity of the information stored and processed by a particular system

The following policies and procedures are relevant to this document:

• Mobile Device Policy

Version 1 Page 4 of 8 [Insert date]

2 Access Control Principles

• How user accounts are created, maintained and deleted

Version 1 Page 5 of 8 [Insert date]

3 User Access Management

3.1 User Registration and Deregistration

3.2 User Access Provisioning

Version 1 Page 6 of 8 [Insert date]

3.3 Removal or Adjustment of Access Rights

3.4 Management of Privileged Access Rights

3.5 Supplier Remote Access to The Organisation Network

Version 1 Page 7 of 8 [Insert date]

supplier’s connections (e.g. on termination of a contract) must be immediately sent to the

3.6 Review Of User Access Rights

• People who should not have access (e.g. leavers)

Version 1 Page 8 of 8 [Insert date]

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.