Policy template

Access Control Policy template

This policy exists to ensure that access to information and systems is authorised, limited to business need and regularly reviewed. It applies to all user, administrator, service and supplier accounts on company systems and cloud services.

Create this policy

What the policy contains

Access management
Authentication
Privileged access

Who is responsible

Information Security Manager
IT Manager
Managers
All staff and contractors

What you decide

Multi-factor authentication required forEmail · Remote access · Cloud services · Administrator accounts · Every account
Access reviewsQuarterly · Every 6 months · Yearly
Access removed for leaversOn the last working day · Within 24 hours · Within 72 hours
A privileged access management tool is used

References covered

ISO/IEC 27001 Annex A: control 5.15
ISO/IEC 27001 Annex A: control 5.16
ISO/IEC 27001 Annex A: control 5.17
ISO/IEC 27001 Annex A: control 5.18
ISO/IEC 27001 Annex A: control 8.2
ISO/IEC 27001 Annex A: control 8.3
ISO/IEC 27001 Annex A: control 8.5
GDPR: Art. 25 data protection by design and by default
GDPR: Art. 32 security of processing
NIS2: Art. 21(2)(i) access control policies
NIS2: Art. 21(2)(j) multi-factor authentication

Access Control Policy template

What the policy contains

Who is responsible

What you decide

References covered

Guides

Other policy templates

Access Control Policy template

What the policy contains

Who is responsible

What you decide

References covered

Guides

Other policy templates