ACCESS CONTROL POLICY
Legal name of the entity
Effective Date
Policy Owner Name or role (for example IT Security)
Access reviews Basis
ISO/IEC 27001 A.5.15 to A.5.18 SOC 2 CC6 This policy restricts access to information and systems on least-privilege and need-to-know, and governs how access is granted, reviewed and removed.
1. Purpose and scope
This policy applies across Legal name of the entity and is owned by Name or role (for example IT Security) . It covers all users, systems and data.
2. Principles and controls
Access is governed by the following controls:
Control In place Least privilege and need-to-know No Role-based access control No Multi-factor authentication for key systems No Joiner, mover, leaver process No Privileged access managed and logged No
3. Access reviews
User and privileged access is reviewed [frequency]; access no longer required is removed promptly.
4. Review and approval
Reviewed [cycle]; approved by Name and designation on [date].
Approved by
Name and designation
______________________
Policy Owner
Name or role (for example IT Security)
______________________