Locking a screen and keeping a password to yourself are simple habits, and this talk explains why they matter. The guidance covers accounts, visitors and third parties for whoever leads it.
This training talk is supplied in fully editable MS Word format, prepared using the F-Q7 Training Talk Attendance Record form template. All text is in Calibri font for improved readability.
The following document labelling is included in the footer:
- Talk number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested training talks. No junk, jargon or unnecessary content. Simple and usable training material
developed over 25 years through practical use in the real world.
Further guidance on access control:
Download this training talk with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
If you'd like hands-on help setting up your access control procedures and your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Access Control and User Authentication Training Talk
A training talk on access control and user authentication for all staff - access only to what each person needs, user accounts, physical security, third-party access and keeping passwords private. The download gives you a one-page attendance record with the talk description already filled in, plus the full guidance document to run the talk from.
Two Files in One Download
- TT-8-04 Access Control and User Authentication - the attendance record, with the topic and talk description ready to use and a signature line for each attendee
- GG-8-04 Access Control and User Authentication - the guidance document the talk is based on, to prepare from and to issue to staff afterwards
Talk Description
- What access control is - access only to what you need for your work
- User accounts for new starters, leavers and role changes
- Physical security - locked premises, keys and escorting visitors
- Access for third parties, and confidentiality agreements
- Individual accounts and passwords - never sharing them
- Your responsibilities - locking unattended devices and reporting compromised passwords
Running the Talk
Read through the guidance beforehand, talk the points through with the team, then have everyone sign the record. Keep the signed record as evidence that the briefing took place and who received it.
Why Passwords Are Never Shared
An account belongs to a single person, so anything done under it is recorded as theirs. The talk explains why passwords are never shared, even with a colleague covering for someone, and why a password that may have been seen or compromised is reported straight away.
Adapting the Talk
Both files are fully editable, so add your password rules, how visitors are signed in and escorted, and who staff should tell about a lost key or a compromised password. Update the talk description if you cover extra points.
Keeping the Training Record
File the signed record with your training records, or log the talk against each attendee in a training matrix, so you can show who has been briefed and when.
Who Is It For?
Every member of staff with a user account or a key to the premises, including temporary staff. It works at induction, as a refresher and when systems or office security arrangements change.
Included in the ISO 27001 and ISO 22301 Toolkits
This training talk is part of the ISO 27001 and ISO 22301 toolkits, and is included in the integrated toolkits that combine them.
Delivering Talks Regularly
Short, regular talks keep information security in front of people. Run this one alongside the other information security training talks to build awareness one topic at a time.
Related Training Talks
Other training talks that work alongside this one:
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan