Password and Access Control Policy Document Summary

Study Notes

The document titled "Password and Access Control Policy" is in draft status, version 0.1, and includes information on roles and responsibilities, authentication, access control configurations, and enforcement.
It outlines specific responsibilities, conditions, and practices to minimize risks and maximize protection of physical assets and sensitive information, aiming to satisfy PCI DSS requirements 7.1 & 7.2, and 8.5.
The policy applies to all systems and assets owned, managed, or operated by the organization.
Roles and responsibilities outlined include those of HR Role/Line Manager, Information Security Manager, and Systems Administrators, with specific duties for each.
User authentication principles include access privileges based on business needs, least privilege observation, and unique user IDs with personal secret passwords.
Various authentication mechanisms and role-based access control are detailed for user, operating system, web, voice, email, fax, white mail, remote access, and network device authentication.
Access control configurations include unique user IDs, password requirements, password history maintenance, lockout settings, two-factor authentication, and account deactivation policies.
The policy mandates changing default passwords before system operation, storing passwords securely, and enforcing regular password changes and account deactivation.
Enforcement measures include disciplinary actions for policy violations and permitting deviations only with a valid business case reviewed and approved by the Security Management Team and/or Legal Counsel.
The document references the Payment Card Industry Data Security Standard (PCI DSS) as a key framework for its requirements and guidelines.
The initial draft template assigns ownership to the Information Security Manager or equivalent, with instructions to edit job titles/descriptions accordingly.
The document also includes a table of contents, document revision history, document distribution/stakeholders, and a section on definitions and references.

Description

Summary of a draft document on Password and Access Control Policy, covering roles and responsibilities, authentication principles, access control configurations, and enforcement measures. The document aims to minimize risks, protect physical assets and sensitive information, and comply with PCI DSS requirements.