Access Management Policy
Control and management of access to information systems and resources
Purpose
Establish how the organization controls access to systems and information, managing the complete identity lifecycle and ensuring secure authentication, the assignment and periodic review of permissions, and the responsible use of privileged tools.
Scope
Applies to all human and non-human identities, systems, applications, utility programs and temporary access within the organization, including third parties.
Key Principles
- Access based on need and role.
- Segregation of duties to minimize risks.
- Recording and auditing of all access rights.
- Use of strong, multi-factor authentication.
- Strict control of utility programs and privileged access.
Roles and Responsibilities
- System Owners: Review and approve access, oversee compliance, report discrepancies.
- IT: Implement access, apply changes to the Control Matrix, audit and monitor systems and utility programs.
- Management: Validate strategic changes, review risks and authorize privileged access.
- Users: Comply with the policy and report incidents.
Account and Identity Management
Provisioning
- Access requested through the ticketing system, with justification.
- Review and approval according to the Access Control Matrix.
- Document all decisions for transparency.
- Third-party access control with NDAs and trust verification.
- Separation of approval and implementation roles to avoid conflicts of interest.
- Automation wherever possible to reduce errors and improve efficiency.
Deprovisioning
- Access removal through tickets.
- Joint review by System Owners, IT and Management.
- Revoke unnecessary privileges and remove duplicate identities.
- Timely removal of access for role changes or departures from the organization.
- Temporary access limited to defined periods and revoked automatically.
- Automation wherever possible to reduce errors and improve efficiency.
Authentication Standards
- Methods selected according to the sensitivity of the information.
- Mandatory multi-factor authentication for systems.
- Brute-force protection: lockout or reset after failed attempts.
- Full credential validation before displaying sensitive information.
- Notification of the last login and failures through a separate channel.
- Limited session duration for applications.
Utility Programs and Privileged Access
- Access restricted to a minimum of authorized, trusted users.
- Segregation of utility programs from application software and their network traffic.
- Availability limited to specific periods, with mandatory usage logging.
- Removal or deactivation of unnecessary utilities, respecting segregation of duties.
Changes to the Access Control Matrix
- All changes require approval from the System Owner, IT and Management (where deemed necessary).
- Document changes and reasons for transparency.
- IT is responsible for implementing changes and keeping the Matrix up to date.
Monitoring and Auditing
- Compliance review by System Owners and IT.
- Central record of all access rights and changes.
- Periodic audits of access, identities and utility programs.
- Adjustment of privileged access according to risk assessment.