# Access Control Policy Template

## Purpose

This policy template establishes rules for managing access to information systems and data. Critical for E-ITS, ISO 27001, SOC 2, and GDPR compliance. Implements principle of least privilege and segregation of duties.

## When to Use

- Implementing/updating ISMS (ISO 27001)
- E-ITS security level compliance
- SOC 2 control implementation
- GDPR technical measures (Article 32)
- User onboarding/offboarding
- Role definition and access reviews
- Audit preparation

## How to Use

1. **Customize**: Adapt to your organization's structure and systems
2. **Define Roles**: Map user roles to access permissions
3. **Implement**: Configure systems according to policy
4. **Train**: Educate staff on policy requirements
5. **Monitor**: Regular access reviews and audits
6. **Update**: Revise as organization/systems change

## Official References

- **ISO 27001:2022**: Annex A 5.15-5.18, 8.2-8.5 (Access control)
- **E-ITS**: § 10 Juurdepääsukontroll
- **GDPR**: Article 32 - Security of processing
- **SOC 2**: CC6.1-CC6.3 - Logical and physical access controls

---

# ACCESS CONTROL POLICY

## 1. Policy Statement

[Organization Name] is committed to protecting information assets by implementing appropriate access controls. This policy ensures that only authorized individuals can access systems and data necessary for their job functions, following the principles of least privilege and need-to-know.

**Effective Date**: _________________
**Version**: 1.0
**Owner**: Chief Information Security Officer (CISO)
**Approved By**: CEO / Board

---

## 2. Scope

This policy applies to:

- **All Personnel**: Employees, contractors, temporary staff, interns
- **All Systems**: IT systems, applications, databases, networks
- **All Data**: Electronic and physical information assets
- **All Access Methods**: On-site, remote, mobile, third-party

**Exclusions**: [List any specific exclusions, e.g., public websites]

---

## 3. Roles & Responsibilities

| **Role** | **Responsibilities** |
|----------|---------------------|
| **CISO / Information Security Manager** | Policy ownership, oversight, approval of access rights |
| **IT Department** | Technical implementation, user provisioning, monitoring |
| **Line Managers / Department Heads** | Request access for team members, approve access based on job function |
| **Data Owners** | Define access requirements for their data/systems, approve sensitive access |
| **HR Department** | Initiate onboarding/offboarding processes, notify IT of status changes |
| **Users** | Use access responsibly, report security issues, comply with policy |
| **Internal Audit / Compliance** | Review and audit access controls, verify compliance |

---

## 4. Access Control Principles

### 4.1 Least Privilege

Users shall be granted the **minimum level of access** required to perform their job duties.

- No default administrative rights
- Access permissions based on role, not seniority
- Temporary elevated access for specific tasks only

### 4.2 Need-to-Know

Access to sensitive information is granted only when there is a **legitimate business need**.

- Segregation between departments
- Project-based access (removed when project ends)
- Sensitive data requires additional justification

### 4.3 Segregation of Duties

Conflicting duties must be separated to prevent fraud or error.

**Examples**:
- Same person cannot both authorize and execute payments
- Developers cannot have production write access
- Auditors cannot have access to systems they audit

### 4.4 Defense in Depth

Multiple layers of access control provide redundancy.

- Network perimeter (firewall, VPN)
- System-level authentication
- Application-level authorization
- Data-level encryption

---

## 5. User Access Management

### 5.1 User Registration and Provisioning

#### New User Process

1. **Request**: Line manager submits access request via [ticketing system]
2. **Approval**:
   - Standard access: Line manager approval
   - Elevated access: Line manager + CISO approval
   - Sensitive data access: Data owner + CISO approval
3. **Implementation**: IT creates account with approved permissions (within 24 hours)
4. **Documentation**: Access recorded in [access management system]
5. **Notification**: User receives credentials via secure channel

**Required Information**:
- User name and employee ID
- Job title and department
- Line manager
- Required systems and access level
- Business justification
- Duration (if temporary)

#### Account Naming Convention

**Format**: `firstname.lastname` (primary account)
**Admin accounts**: `firstname.lastname-admin`
**Service accounts**: `svc-[service-name]`

**Rules**:
- Unique username per person
- No shared accounts (except where technically unavoidable)
- Admin accounts separate from regular accounts

### 5.2 User Deprovisioning

#### Termination Process

**Immediate actions upon notification**:
- [ ] Disable all user accounts (within 1 hour of HR notification)
- [ ] Revoke remote access (VPN, cloud services)
- [ ] Disable email forwarding
- [ ] Change shared passwords known to user
- [ ] Collect physical access cards, keys, devices

**Within 24 hours**:
- [ ] Transfer data ownership to line manager
- [ ] Archive or delete mailbox (per retention policy)
- [ ] Document access revocation
- [ ] Remove from distribution lists and teams

**Within 7 days**:
- [ ] Delete account (or archive per retention policy)
- [ ] Audit for residual access

#### Status Changes

| **Event** | **Action** | **Timeframe** |
|-----------|------------|---------------|
| **Resignation** | Disable on last working day | Day 1 |
| **Termination** | Immediate disable | < 1 hour |
| **Leave of Absence** | Disable account | Start of leave |
| **Return from Leave** | Re-enable account | Prior to return |
| **Role Change** | Adjust permissions | Same day |

### 5.3 Periodic Access Reviews

**Frequency**: Quarterly

**Process**:
1. IT generates access report for each manager
2. Managers review and confirm each user's access is appropriate
3. Identify and remove unnecessary access
4. CISO reviews high-privilege accounts
5. Document review results

**Triggers for Ad-Hoc Review**:
- Security incident
- Organizational changes
- System changes
- Regulatory audit

---

## 6. Authentication Requirements

### 6.1 Password Policy

**Minimum Requirements**:
- **Length**: 12 characters minimum
- **Complexity**: Mix of uppercase, lowercase, numbers, symbols
- **Uniqueness**: Cannot reuse last 5 passwords
- **Expiry**: 90 days (administrative accounts: 60 days)
- **Lockout**: 5 failed attempts = 30-minute lockout

**Prohibited**:
- Dictionary words
- Personal information (name, birthday)
- Common patterns (123456, password, etc.)
- Shared passwords

**Password Storage**:
- Use approved password manager
- Never write down passwords
- Never send via email or chat

### 6.2 Multi-Factor Authentication (MFA)

**Required for**:
- All remote access (VPN, cloud services)
- Administrative accounts
- Access to sensitive data (financial, personal data)
- Email (executive team minimum)

**Accepted MFA Methods**:
1. **Preferred**: Authenticator app (Microsoft Authenticator, Google Authenticator, Authy)
2. **Alternative**: Hardware token (YubiKey, RSA SecurID)
3. **Last Resort**: SMS (only if no other option - security concerns)

**Prohibited**: Email-based MFA

### 6.3 Single Sign-On (SSO)

Where implemented:
- Centralized authentication via [Azure AD / Okta / Google Workspace]
- Reduces password fatigue
- Simplifies access management
- Provides centralized audit logs

### 6.4 Session Management

- **Timeout**: 15 minutes of inactivity (workstations), 30 minutes (applications)
- **Screen lock**: Mandatory when leaving workstation
- **Re-authentication**: Required for sensitive operations
- **Concurrent sessions**: Maximum 3 per user

---

## 7. Role-Based Access Control (RBAC)

### 7.1 Standard User Roles

| **Role** | **Description** | **Typical Access** | **Approval** |
|----------|-----------------|-------------------|--------------|
| **Employee (Standard)** | Regular staff | Email, file shares, business apps | Line Manager |
| **Developer** | Software development | Source code, dev environments, testing tools | IT Manager + CISO |
| **Finance** | Accounting/finance | Financial systems, payroll, invoicing | CFO |
| **HR** | Human resources | HRIS, employee records, recruitment tools | HR Director |
| **IT Support** | Technical support | User management, basic system admin | IT Manager |
| **IT Administrator** | System administrators | Full system access, infrastructure | CISO |
| **Security** | Security team | Security tools, logs, incident response | CISO |
| **Executive** | C-level leadership | All systems (read), strategic systems (write) | CEO |

### 7.2 Privileged Access

**Definition**: Accounts with administrative/root rights

**Requirements**:
- **Separate admin account** (not used for daily work)
- **Approval**: CISO required
- **MFA**: Mandatory
- **Logging**: All actions logged
- **Time-limited**: Access reviewed every 30 days
- **Privileged Access Management (PAM)**: Use PAM solution where available

**Privileged Account Types**:
- Local administrator (Windows/Mac)
- Domain admin (Active Directory)
- Root/sudo (Linux)
- Database admin (DBA)
- Cloud admin (AWS/Azure console)
- Network admin (switches, routers, firewalls)

### 7.3 Service Accounts

**Purpose**: Non-human accounts for automated processes

**Requirements**:
- **Naming**: `svc-[service-name]`
- **Ownership**: Designated IT owner
- **Credentials**: Long, random passwords stored in PAM/vault
- **MFA**: Where supported, use certificate-based authentication
- **Monitoring**: Alert on unexpected usage
- **Review**: Quarterly review of active service accounts

---

## 8. Access Control for Specific Assets

### 8.1 Network Access

**Internal Network**:
- Physical connection or VPN required
- Network segmentation (VLANs)
- Guest network (isolated, no access to internal resources)

**Remote Access (VPN)**:
- Requires MFA
- Endpoint security (antivirus, encryption, patching)
- Split-tunnel prohibited (all traffic through VPN)
- Logging and monitoring enabled

**Wi-Fi**:
- Corporate Wi-Fi: WPA3-Enterprise (802.1X authentication)
- Guest Wi-Fi: Separate SSID, no internal access

### 8.2 Database Access

- **Production databases**: Read-only for developers, write access for DBA only
- **Encryption**: All connections over TLS
- **Credentials**: Stored in secrets manager, rotated quarterly
- **Auditing**: All queries logged (especially data exports)

### 8.3 Cloud Services (SaaS/PaaS/IaaS)

- **SSO**: Use centralized identity provider
- **MFA**: Required for all cloud admin portals
- **Conditional Access**: Restrict access by location/device
- **Data Residency**: Ensure data stored in compliant regions

### 8.4 Source Code Repositories

- **Access**: Based on project involvement
- **Branch Protection**: Require pull request reviews for main branch
- **Secrets**: Never commit credentials (use secrets management)
- **Audit**: Track who cloned/accessed repositories

### 8.5 Financial Systems

- **Segregation**: Request, approve, execute separated
- **Dual Authorization**: Payments > €10,000 require two approvers
- **Read-Only**: Access for auditors, reports for management
- **Activity Monitoring**: Alerts on unusual transactions

### 8.6 Personal Data (GDPR)

- **Data Minimization**: Access only to necessary personal data fields
- **Purpose Limitation**: Access justified by processing purpose
- **Logging**: All access to personal data logged
- **Encryption**: At rest and in transit
- **Deletion**: Automatic revocation when purpose no longer applies

---

## 9. Physical Access Control

### 9.1 Facility Access

- **Access cards**: Issued by HR/Security
- **Visitor log**: All visitors registered and escorted
- **Restricted areas**: Server rooms, secure storage - limited access
- **Tailgating prevention**: "One person, one card" policy

### 9.2 Server Rooms / Data Centers

- **Access**: IT staff only (plus approved vendors)
- **Logging**: Entry/exit logged (badge system)
- **Video Surveillance**: 24/7 recording, 90-day retention
- **Environmental Controls**: Fire suppression, temperature monitoring

### 9.3 Devices

- **Laptops/Desktops**: Full disk encryption mandatory
- **Mobile Devices**: MDM enrollment, remote wipe capability
- **USB Devices**: Restricted (whitelisted only)
- **Lost/Stolen**: Report immediately to IT

---

## 10. Monitoring and Audit

### 10.1 Logging

**What is logged**:
- All login attempts (successful and failed)
- Privileged account usage
- Access to sensitive data
- Configuration changes
- Account provisioning/deprovisioning

**Retention**: 12 months (critical systems: 24 months)

### 10.2 Monitoring

- **Real-time alerts**: Failed logins, privilege escalation, after-hours access
- **Daily review**: Security team reviews high-risk events
- **SIEM**: Centralized log collection and correlation

### 10.3 Audit Trail

All access-related activities must be:
- **Recorded**: Who, what, when, where
- **Tamper-proof**: Logs cannot be deleted or modified by users
- **Reviewable**: Accessible for security/compliance audits
- **Retained**: Per legal/regulatory requirements

---

## 11. Third-Party Access

### 11.1 Vendor Access

**Requirements**:
- **NDA**: Signed before access granted
- **DPA**: Data processing agreement if handling personal data
- **Justification**: Document business need
- **Time-limited**: Access expires automatically
- **MFA**: Required for remote access
- **Monitoring**: All vendor activity logged

**Process**:
1. Vendor submits access request via [vendor management system]
2. Business owner approves
3. CISO approves (if elevated access or sensitive data)
4. IT provisions with minimum necessary access
5. Quarterly review of active vendor access

### 11.2 Contractor Access

Treat as regular employees but:
- **Contract duration**: Access expires with contract end date
- **Manager notification**: Required for renewals
- **Restrictions**: No admin rights without CISO approval

---

## 12. Exceptions

### 12.1 Exception Process

**When exceptions may be granted**:
- Technical limitations
- Business-critical requirement
- Vendor requirement
- Emergency/crisis situation

**Requirements**:
- **Written justification**
- **Compensating controls**: Alternative security measures
- **Approval**: CISO + Senior Management
- **Time-limited**: Maximum 90 days
- **Review**: Documented in quarterly access review

**Emergency Access**:
- "Break-glass" accounts for critical situations
- Requires post-incident review and documentation

---

## 13. Training and Awareness

All users must complete:
- **Onboarding**: Access control policy training (before access granted)
- **Annual Refresher**: Policy updates and best practices
- **Role-Specific**: Additional training for privileged users

Topics:
- Password best practices
- MFA usage
- Recognizing phishing/social engineering
- Reporting security incidents

---

## 14. Compliance and Enforcement

### 14.1 Violations

Examples of policy violations:
- Sharing passwords
- Using personal accounts for business
- Accessing unauthorized systems/data
- Failing to report security incidents
- Leaving workstations unlocked

### 14.2 Consequences

- **First Violation**: Written warning, retraining
- **Repeated Violations**: Suspension, access revocation
- **Serious Violations**: Termination, legal action

---

## 15. Policy Review and Updates

- **Review Frequency**: Annually
- **Triggers**: Security incidents, regulatory changes, technology changes
- **Approval**: CISO recommends, CEO/Board approves
- **Communication**: All changes communicated to users

---

## Appendix A: Access Request Form Template

**Requestor Information**:
- Name: _________________
- Employee ID: _________________
- Department: _________________
- Line Manager: _________________

**Access Details**:
- System/Application: _________________
- Access Level: ☐ Read-Only  ☐ Read-Write  ☐ Admin
- Business Justification: _________________________________
- Duration: ☐ Permanent  ☐ Temporary (End Date: ________)

**Approvals**:
- Line Manager: _________________ Date: _______
- Data Owner (if applicable): _________________ Date: _______
- CISO (if privileged): _________________ Date: _______

---

## Appendix B: Access Review Checklist

**Review Period**: __________
**Reviewer**: __________

For each user, confirm:
- [ ] User still employed/active
- [ ] Job role still requires this access
- [ ] Access level appropriate (least privilege)
- [ ] No dormant accounts (> 90 days inactive)
- [ ] Privileged access still justified

**Actions**:
- Accounts to revoke: _________________________________
- Access to reduce: _________________________________
- Issues identified: _________________________________

**Approval**:
- Reviewer Signature: _________________ Date: _______
- CISO Approval: _________________ Date: _______

---

**Template Version**: 1.0
**Last Updated**: 2024-01-04
**Source**: InfoPol - Free InfoSec Resources