Access Control Policy

Inside the document

1. Principles
2. Identity and account management
3. Requesting and approving access
4. Authentication
5. Privileged access
6. Changes and removal
7. Review and monitoring

Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.

Sample clause · Privileged accessEmergency (break-glass) accounts shall be sealed, tested at least [twice a year], monitored for any use, and re-secured after each use.

What an auditor will check

Every account maps to a person, access was approved, leavers lost access on time, admin rights are controlled and reviews really happen.