## 1. Purpose

This policy defines how access to company systems, applications, data, and administrative functions should be granted, reviewed, changed, and removed.

The goal is to ensure people have the access they need for their work without maintaining unnecessary privileges.

## 2. Least Privilege

- Access should be based on business need.

- Users should receive only the minimum access reasonably required for their role.

- Access should not be granted simply because it may be useful someday.

## 3. Access Approval

Access to sensitive or critical systems should be approved by an appropriate manager, system owner, data owner, or other designated authority.

High-risk access may require additional approval.

**Examples include:**

- Administrator access
- Finance access
- Payroll access
- HR data
- Customer databases
- Backup administration
- Security tools
- Cloud administration
- Source code repositories

## 4. Individual Accounts

Individual named accounts should be used wherever practical.

Shared accounts should be avoided because they reduce accountability.

**Where shared accounts cannot be eliminated, they should have:**

- A business owner
- A documented purpose
- Restricted membership
- Controlled credentials
- Periodic review

## 5. Privileged Access

Privileged access should receive additional protection.

**The company should:**

- Limit the number of administrators
- Use separate administrator accounts where practical
- Require MFA
- Review privileged accounts regularly
- Remove unused privileges
- Log important administrator activity
- Restrict vendor administrator access

## 6. Joiners, Movers, and Leavers

Access should follow the employee lifecycle.

**For new employees:**

- Access should be approved before it is granted.

**For role changes:**

- Existing access should be reviewed rather than simply adding new access.

**For departing users:**

- Access should be removed promptly based on the departure circumstances.

This also applies to contractors, temporary workers, and vendors.

## 7. Access Reviews

Access to important systems should be reviewed periodically.

Higher-risk access should be reviewed more frequently.

**Reviews should include:**

- Administrator accounts
- Finance and payroll
- Sensitive data
- Cloud and SaaS administrators
- Backup systems
- Vendor and MSP access
- Shared accounts
- Service accounts
- Former employees and contractors

## 8. Vendor and Third-Party Access

**Third-party access should:**

- Have an internal owner.
- Use named accounts where practical.
- Use MFA.
- Be limited to necessary systems.
- Be time-limited where possible.
- Be reviewed periodically.
- Be removed when no longer required.

## 9. Service Accounts

**Service accounts should:**

- Have a named business or technical owner.
- Use only required permissions.
- Avoid interactive login unless necessary.
- Use securely managed credentials or secrets.
- Be reviewed periodically.
- Be disabled when no longer required.

## 10. Emergency Access

Emergency or break-glass accounts should be tightly controlled.

**The company should:**

- Limit who can access them.
- Protect credentials securely.
- Require strong authentication where technically possible.
- Monitor use.
- Review activity after use.

Test that emergency access works without using it for routine administration.

## 11. Access Removal

**Access should be removed when:**

- Employment ends
- A contract ends
- A vendor relationship ends
- A user changes roles and no longer needs it
- A system is retired
- Access is no longer justified
- Security concerns require suspension

## 12. Records

Important access approvals, reviews, exceptions, and removals should be documented.

**Evidence may include:**

- Access request forms
- Approval records
- Access review reports
- Screenshots
- System exports
- Offboarding records
- Ticket records

## Practical Rule

Give people the access they need, no more than they need, and no longer than they need it.