Access Control

Purpose

Access control ensures that only authorised people can access systems, repositories, data, and environments.

Access Principles

• least privilege

• role-based access

• named user accounts

• no shared credentials

• timely removal of access

• periodic access review

• multi-factor authentication where required

Access Request

Access requests should record:

• requester

• role

• system

• reason

• approval

• access level

• start date

• end date

• review date

Offboarding

Access must be removed when:

• a person leaves the project

• a supplier engagement ends

• a role changes

• the customer requests removal

• access is no longer needed