Access Control Policy
1. General Access Control Principles
- Least privilege – users receive only the permissions necessary for their work.
- Need-to-know – access to data is granted only to persons who require it for their duties.
- Segregation of duties – critical operations require more than one person.
- Default deny – access is prohibited until explicitly granted.
- Accountability – every access is logged and attributed to a specific user.
2. User Account Management
2.1 Account creation and modification
Accounts are created solely on the basis of a formal request approved by the line manager and administrator. Request template: ▸ [link / form location].
| Account type | Approval | MFA | Access review |
|---|---|---|---|
| Standard user | ▸ [line manager] | ▸ Recommendedrequired from 2025 | ▸ every 12 monthsmin. 1×/year |
| Privileged account (admin) | ▸ CISO + line manager | ABSOLUTELY REQUIRED | ▸ every 6 monthsmin. 2×/year |
| Service / technical account | ▸ CISO + admin | N/A (password rotated) | ▸ every 6 months |
| External account (supplier) | ▸ CISO + system owner | REQUIRED | ▸ every 3 monthsmin. 1×/year |
| Emergency account (break-glass) | ▸ CISO + Board | REQUIRED | ▸ every 6 months |
2.2 Account blocking and deletion
- Block on role change – immediately upon HR decision.
- Block on employment termination – no later than ▸ [on the day of departure, by 17:00]max. 24h. Procedure in DOC-016.
- Automatic block of inactive accounts after ▸ [90 days]max. 90 days of no login.
- Account deletion after ▸ [30 days] from block, after system owner confirmation.
2.3 Access review
System owners review permissions every ▸ [6 months]min. 1×/year. Privileged accounts every ▸ [3 months]min. 2×/year. Results documented in review register. Excessive permissions removed within ▸ [5 business days] of identification.
3. Password Policy
3.1 Standard user passwords
| Parameter | NIS2 / best practice minimum | Organisation's policy |
|---|---|---|
| Minimum password length | min. 8 characters | ▸ [enter number, e.g. 12]min. 8 characters |
| Upper case letters (A–Z) | Recommended | ▸ [required / recommended] |
| Lower case letters (a–z) | Recommended | ▸ [required / recommended] |
| Digits (0–9) | Recommended | ▸ [required / recommended] |
| Special characters (!@#$…) | Recommended | ▸ [required / recommended] |
| Maximum password age | No mandatory max. (NIST SP 800-63B recommends no expiry with good complexity) | ▸ [e.g. 365 days / no expiry] |
| Password history (no reuse) | Recommended min. 5 | ▸ [e.g. last 10]min. 5 |
| Lockout after failed attempts | Recommended | ▸ [e.g. after 5 attempts]max. 10 attempts |
| Lockout duration / unlock | — | ▸ [e.g. 15 min automatic / manually by admin] |
| Screen lock after inactivity | Recommended | ▸ [e.g. 10 minutes]max. 15 min |
3.2 Privileged account passwords (administrators)
| Parameter | Minimum (ENISA recommendation) | Organisation's policy |
|---|---|---|
| Minimum length | min. 16 characters | ▸ [e.g. 20 characters]min. 16 characters |
| Complexity | All 4 character categories | Upper + lower + digits + special characters – MANDATORY |
| Maximum age | — | ▸ [e.g. 90 days]max. 180 days |
| PAM tool / password manager | Recommended | ▸ [e.g. CyberArk / BeyondTrust / HashiCorp Vault / KeePass Enterprise] |
3.3 Service account passwords
Length: ▸ min. 32 random charactersmin. 20 characters, auto-generated (PAM or script). Rotation every ▸ [90 days]max. 180 days or after any security incident.
3.4 Absolute prohibitions
- No dictionary words, names, dates of birth, organisation name as passwords.
- No sharing of passwords between users.
- No storing passwords in text files, emails, instant messengers, sticky notes on monitors.
- No using the same passwords for work and personal systems.
4. Multi-Factor Authentication (MFA)
| Access scenario | MFA requirement | Accepted methods |
|---|---|---|
| Remote access (VPN, RDP, SSH) | ABSOLUTELY REQUIRED | ▸ [TOTP (Google/MS Authenticator) / FIDO2 / hardware token] |
| Privileged accounts (admins) | ABSOLUTELY REQUIRED | ▸ [FIDO2 / hardware token (YubiKey) / TOTP] |
| Key systems / OT/ICS | REQUIRED – SMS not acceptable | ▸ FIDO2 or hardware token ONLY |
| Cloud admin panels (AWS/Azure/GCP) | REQUIRED | ▸ |
| Email (remote web access) | ▸ [Required]min. for remote access | ▸ [TOTP / push notification] |
| Internal network access (office) | ▸ [Required / Recommended] | ▸ |
Not acceptable: SMS as MFA method for privileged accounts and key systems (SIM swapping vulnerability). SMS only acceptable for standard accounts as a fallback option.
MFA platform: ▸ [e.g. Microsoft Entra ID MFA / Duo Security / RSA SecurID / YubiKey / FreeOTP]
Full MFA deployment date for privileged accounts: ▸ DD/MM/YYYY
Percentage of accounts covered by MFA: ▸ [e.g. 100% privileged, X% standard]
5. Privileged Access Management (PAM)
- Each administrator has two separate accounts: standard (daily work) and privileged (administrative tasks only).
- Privileged account logins recorded in a central audit log.
- Privileged sessions recorded and archived for ▸ [12 months]min. 12 months – NIS2.
- Temporary Just-In-Time (JIT) access: granted for max. ▸ [4 hours], requires re-approval by CISO.
- Break-glass accounts: password in sealed envelope in CISO safe; opening recorded in incident register.
PAM system: ▸ [e.g. CyberArk / BeyondTrust / HashiCorp Vault / manual management with register]
Privileged account register: ▸ [register location / link to DOC-020]
6. Remote and External Access
| Access type | Requirements | Tool |
|---|---|---|
| Employee VPN | MFA required; company devices or MDM only; Split tunnelling: ▸ [allowed/prohibited] | ▸ [e.g. OpenVPN / Cisco AnyConnect / WireGuard] |
| Supplier remote access | MFA required; only during work period; session monitored via PAM; no access outside contract scope | ▸ [e.g. dedicated VPN / BeyondTrust Remote Access] |
| Remote work (home office) | Encrypted disk; VPN mandatory; screen lock after ▸ [5 min]max. 15 min | ▸ |
| BYOD (personal devices) | ▸ [Permitted / Not permitted] – if permitted: MDM mandatory, separation of work data | ▸ [e.g. Microsoft Intune / JAMF] |
7. Access Logging and Monitoring
All system logins are recorded and retained for ▸ [12 months]min. 12 months – NIS2. Minimum log content: user ID, timestamp (UTC), source IP address, target system, event type, result (success/denied).
SIEM alerts configured for: logins outside business hours, repeated authentication failures, logins from new locations, privilege escalation. Details in DOC-019.
8. Change History
| Version | Date | Author | Description | Approved by |
|---|---|---|---|---|
| ▸ 1.0 | ▸ DD/MM/YYYY | ▸ | ▸ Initial release | ▸ Board |