Access Control Policy Overview

Access Control Policy Summary

• The Access Control Policy is designed to minimize risks and protect physical assets and sensitive information.
• The policy is created to meet specific requirements of the Payment Card Industry Data Security Standard (PCI DSS).
• The policy applies to all systems and assets owned, managed, or operated by the organization.
• The HR role/line manager informs IT about new employees, changes to access rights, and leavers.
• The Information Security Manager approves access requests and audits user and access lists quarterly.
• Systems Administrators adhere to the policy when making changes to access privileges and ensure system configurations are enforced.
• User authentication is based on business needs, with privileges assigned based on job classification and function.
• Non-authenticated or shared user IDs are prohibited.
• Each user must have a unique user ID and personal secret password for system and network access.
• Authentication mechanisms must be appropriate for the delivery channel.
• Secure mechanisms for authentication are required for operating system access and web applications.
• Two-factor authentication must be used for remote access and network device access.