Access control explained in plain terms, covering starters, leavers, third parties, passwords and keeping your own login private.
This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Guidance number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents
developed over 25 years through practical use in the real world.
Further guidance on access control and passwords:
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. The guidance is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
If you'd like hands-on help setting up your access control and user account processes, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Access Control and User Authentication Guidance
A general guidance document on access control and user authentication, for all employees who use company systems and those who manage access. It explains how access rights are set and reviewed, starters, leavers and role changes, physical security, third-party access, IT equipment, password controls and each user's responsibilities.
Topics Covered
- What access control is - controlling access to systems so that people only reach what they need for their work
- Starters, leavers and role changes - granting, removing and reviewing access as people join, leave or change role, based on information classification
- Physical security - locked premises, a record of who holds keys, escorted visitors, secure storage and clear desk and clear screen rules
- Third-party access - reviewing and approving access case by case, with contracts and confidentiality or non-disclosure agreements
- Access reviews and IT equipment - ongoing reviews of access rights, recording all IT equipment and its owner, and reviewing event logs
- Passwords and authentication - individual accounts with no generic logins, secure password resets, logging, role management and identity checks
- Your responsibilities - never sharing accounts, locking unattended devices, keeping login details out of sight and reporting role changes
Who Is It For?
All employees who use company systems, and the managers and IT staff who grant, review and remove access.
Included in the ISO 27001 and ISO 22301 Toolkits
This guidance is supplied with the TT-8-04 Access Control and User Authentication training talk, which is part of the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
Using the Guidance
Issue it at induction, go through it with the matching training talk, and keep it as a reference for managers handling starters, leavers and role changes. Record who has received it, for example on the training matrix.
What IT Systems Enforce
The guidance lists the controls IT systems are set up to enforce: authentication of individual users rather than groups, with no generic accounts, protection of password details when they are retrieved or reset, user-level logging of access, role management so tasks never need shared passwords, and password administration that is controlled, secure and auditable.
Adapting the Guidance
Edit the guidance to match your own arrangements - how access is requested and approved, who holds keys to the premises, your visitor and clear desk rules, and who users report access problems to.
Related Documents
Other documents that work alongside this guidance:
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan