This policy procedure sets out how access to systems, information and premises is granted, reviewed and removed, and points to the register that records equipment and logins.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on access control:
Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download.
If you'd like hands-on help setting up user access, starter and leaver controls, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Access Control Policy Procedure Template
The Access Control Policy Procedure is a Word template that sets out how a business controls access to information to prevent unauthorised access. It covers access risks, user accounts for new starters, leavers and role changes, physical access to premises, third party access, secret authentication, reviews of access rights, IT equipment and logins, and user responsibilities.
It applies to all employees and company activities, with disciplinary action for breaches. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.
What the Policy Covers
- Amendment record, summary, scope and applicability - the purpose of preventing unauthorised access to information, the activities and staff covered, and disciplinary action for breaches
- Management of access control risks - periodic risk assessments of access to information assets, with findings actioned and the policy kept in line with current controls
- User accounts and physical access - access granted, reviewed or deactivated for new starters, role changes and leavers, locked premises, escorted visitors and recorded office keys
- Access control for third parties - case by case approval of third party access, contractual agreements for the project or contract, and confidentiality agreements
- Secret authentication and access reviews - identity checks against personal file details, a pass code for higher security needs, and ongoing review of user access rights
- IT equipment, logins and user responsibilities - equipment identified with an owner, authenticated logins, reviewed event logs, logged third party system logins and no shared user accounts
Built for Controlled Access to Information
- Access permissions reviewed for new starters, deactivated for leavers and checked when someone changes role
- Visitors escorted and accompanied at all times on the premises
- Confidentiality agreements required for third parties who access confidential information
- Event logs of user activity reviewed on an ongoing basis and retained for future use
- Logins to company and third party systems holding company information logged
Who Needs an Access Control Policy Procedure?
Any business that needs to control who can reach its systems, information and premises, including those that give third parties access to internal systems.
How the Policy Fits Together
Office keys, IT equipment and logins are recorded on ER10 IT Equipment Logins Register, and staff keep desks and screens clear in line with P-23 Clear Desk Clear Screen Policy.
Using the Policy
Edit the starter, leaver and role change steps, visitor arrangements and identity check details to match your own, and name the person in the Controlled By field. Give it top level approval and brief staff on their user responsibilities.
Related Documents
GG-8-04 Access Control and User Authentication Guidance and TT-8-04 Access Control and User Authentication Training Talk help managers and staff put access controls into practice.
Checking Identity Before Sharing Information
Where the identity of a member of staff or other personnel needs to be validated, the policy uses details already held on their personal file, such as date of birth or postcode. For higher security requirements, a pass code is set up and retained for that person.
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan