Access Control Policy (Annex A.5.15, A.8.2, A.8.5)

1. Principle of Least Privilege

Users are granted the minimum level of system access necessary to perform their daily duties.

2. Authentication Standards

• Multi-Factor Authentication (MFA): Enforced across all cloud environments (M365, AWS, GitHub), administrative consoles, and remote access VPNs without exception.
• Password Complexity: Minimum 14 characters; banned passphrase filtering enabled; credential reuse prohibited.
• Session Controls: Inactive workstations lock automatically after 15 minutes.

3. Privileged Access Management (PAM)

• Standard day-to-day accounts (email, web browsing) must never hold local or cloud administrative privileges.
• Dedicated, segregated administrator accounts (e.g., admin.username@domain) must be used exclusively for administrative tasks.
• Privilege allocations are formally audited and re-certified every 90 days.