security-policies/policies/access-control.md

Access Control Policy

Version: 1.4 | Owner: IT Security | Classification: Internal

Principles

All access rights must be granted on a need-to-know basis (principle of least privilege). Access reviews are conducted quarterly by department managers.

Joiner / Mover / Leaver

Event	Action	Timeline
Joiner	Provisioning ticket to IT	Before first day
Internal move	Access review with old and new manager	Within 5 working days
Leaver	Immediate revocation	Within 2 hours of exit

Privileged access

All privileged accounts require:

• Separate named account (no shared admin accounts)
• Approval from department head + CISO
• Annual re-certification
• Session recording in CyberArk