# Access Control Policy

> **Template — adapt before use.** Replace `[bracketed]` placeholders and have an owner approve it. Starting point only; not legal or compliance advice.

| | |
|---|---|
| **Owner** | [Role] |
| **Approved date** | [YYYY-MM-DD] |
| **Review cadence** | Annual |
| **Version** | 1.0 |

Maps to: PCI DSS Req 7 & 8 · ISO 27001 A.5.15–5.18, A.8.2–8.5 · SOC 2 CC6 · HIPAA §164.312(a).

## 1. Purpose
To ensure access to [Company Name] systems and data is granted, reviewed, and revoked on the principles of least privilege and need-to-know.

## 2. Scope
All systems, applications, and data stores, and all users (employees, contractors, service accounts).

## 3. Policy statements
### 3.1 Provisioning
- Access is granted only on an approved request tied to a job role.
- Default is deny; users receive the minimum access needed to perform their role.
- Privileged (admin) access is granted sparingly, individually attributable, and logged.

### 3.2 Authentication
- Each user has a unique ID; shared accounts are prohibited except where technically unavoidable and compensating controls exist.
- Multi-factor authentication is required for remote access, administrative access, and access to sensitive data.
- Passwords meet [length/complexity] requirements and are stored only as salted hashes.

### 3.3 Review
- User access is reviewed at least [quarterly]; privileged access at least [quarterly]; results are recorded and signed off (see _Access Review Log_).
- Service and machine accounts are inventoried and reviewed on the same cadence.

### 3.4 Deprovisioning
- Access is revoked within [24 hours] of termination or role change.
- Dormant accounts are disabled after [90 days] of inactivity.

## 4. Enforcement
Exceptions require written approval, a compensating control, and an expiry date. Violations are handled under the _Information Security Policy_.

## Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | [YYYY-MM-DD] | [Name] | Initial issue |