Controls

Access Provisioning and Deprovisioning

Access changes require manager or security team approval. Access is provisioned during onboarding and promptly revoked upon role change or termination.

Multi-Factor Authentication (MFA)

MFA is required for all critical systems, production environments, and SSO. Approved methods include authenticator apps, hardware tokens, and push notifications.

Password Management

The organization enforces password policies covering length, complexity, and rotation requirements. A password manager is used to securely store and generate credentials.

Privileged Access Management

Access to critical systems and production data requires case-by-case approval. Privileged access is temporary, audited, and granted only through secured channels.

Role-Based Access Control (RBAC)

Access to systems and applications is granted based on the user's job role following the principle of least privilege.

Access Reviews

User access rights are reviewed at least quarterly. Unnecessary or excessive permissions are promptly revoked to maintain least-privilege access.

Single Sign-On (SSO)

The organization uses SSO for internal systems to centrally manage user identities and access across all business applications.