Password and Access Control Policy Document Summary

Password and Access Control Policy Document Summary

• The document titled "Password and Access Control Policy" is in draft status, version 0.1, and includes information on roles and responsibilities, authentication, access control configurations, and enforcement.
• It outlines specific responsibilities, conditions, and practices to minimize risks and maximize protection of physical assets and sensitive information, aiming to satisfy PCI DSS requirements 7.1 & 7.2, and 8.5.
• The policy applies to all systems and assets owned, managed, or operated by the organization.
• Roles and responsibilities outlined include those of HR Role/Line Manager, Information Security Manager, and Systems Administrators, with specific duties for each.
• User authentication principles include access privileges based on business needs, least privilege observation, and unique user IDs with personal secret passwords.
• Various authentication mechanisms and role-based access control are detailed for user, operating system, web, voice, email, fax, white mail, remote access, and network device authentication.
• Access control configurations include unique user IDs, password requirements, password history maintenance, lockout settings, two-factor authentication, and account deactivation policies.
• The policy mandates changing default passwords before system operation, storing passwords securely, and enforcing regular password changes and account deactivation.
• Enforcement measures include disciplinary actions for policy violations and permitting deviations only with a valid business case reviewed and approved by the Security Management Team and/or Legal Counsel.
• The document references the Payment Card Industry Data Security Standard (PCI DSS) as a key framework for its requirements and guidelines.
• The initial draft template assigns ownership to the Information Security Manager or equivalent, with instructions to edit job titles/descriptions accordingly.
• The document also includes a table of contents, document revision history, document distribution/stakeholders, and a section on definitions and references.