Access Control Policy Template

Clean, unbranded markdown template. Free to download or copy.

# Access Control Policy Template

## 1. Objective & Purpose
The purpose of this Access Control Policy is to define rules for provisioning, reviewing, and decommissioning access to [Company Name]'s IT resources, networks, databases, and physical facilities.

## 2. Authentication & Credential Standards
- Multi-Factor Authentication (MFA) must be enforced for all cloud services, production environments, and source repositories.
- Workstations must enforce password requirements including length (minimum 12 characters), complexity, and lockout after 5 failed attempts.
- Password sharing is strictly prohibited; all users must utilize unique credentials.
- Workstations must automatically lock screens after 10 minutes of inactivity.

## 3. Provisioning & De-Provisioning Access
- **Least Privilege**: Users are granted only the minimum level of access required to perform their daily jobs.
- **Onboarding Access**: Access is requested by department heads, approved by IT/Security, and logged.
- **Offboarding Access**: All access must be deactivated immediately (within 24 hours) upon employee termination.
- **Access Reviews**: All administrative and critical database access rights must be audited and verified quarterly.

---
**Template License**: Free to use, adapt, and modify under CC0/Public Domain. No attribution or branding required.

How to Customize This Template

Access control is one of the most heavily scrutinized areas during any IT security audit. This template defines how your organization controls administrative boundaries. Be sure to align the policy text with your actual tooling configurations.

Key Variables to Customize

  • Password Parameters: If you use an SSO provider like Okta or Google Workspace, match the password rules (length, history, complexity) to the exact settings configured in those systems.
  • Auto-Lock Durations: The template defines a 10-minute workstation screen lockout. If your team's MDM is configured for 5 or 15 minutes, adjust the policy text accordingly.
  • Offboarding Window: While 24 hours is the gold standard for compliance audits, specify a timeline that your HR and IT teams can realistically and consistently meet.

Implementing Access Reviews (Quarterly Audits)

Auditors don't just want to see a policy that says you review access; they want to see the evidence of the review. Implement this quarterly workflow:

  1. Export User Lists: On the first week of every quarter, export lists of active users from critical applications (GitHub, AWS, Google Workspace, billing tools).
  2. Conduct Management Reviews: Send the lists to department heads to verify if access is still aligned with the user's role (Least Privilege check).
  3. Document Corrections: If stale user accounts or incorrect access levels are found, create a ticket to remove or downgrade them. Archive the exported lists, review communications, and ticket timestamps as audit evidence.

Common Auditor Findings & How to Avoid Them

Common Gaps:

  • Delayed Offboarding: An employee leaves the company, but their Google Workspace account remains active for weeks. Set up automated de-provisioning triggers in your HRIS (e.g., Rippling, Gusto) to lock logins instantly.
  • Bypassing MFA: Enforcing MFA globally but leaving specific "service accounts" or "API integrations" exempt without documented security exceptions (such as IP-whitelisting or strong API keys).
  • Shared Administrative Logins: Using a single root or admin account for a database or hosting panel. Every administrator must use a unique profile to maintain an auditable track of system changes.

Access Control Policy FAQs

What does the Principle of Least Privilege mean?

It means restricting user access permissions to only the systems, networks, and databases absolutely necessary to complete their specific job role. For example, marketing personnel should never have read or write access to production database servers.

How do we prove to an auditor that offboarding occurred within 24 hours?

Auditors will select a sample of employees who left the company during the audit window. They will compare the HR termination date (from payroll or offboarding logs) against the account deactivation timestamps in your IDP (Google/Okta) and source repositories.