Password and Access Control Policy Summary

Password and Access Control Policy Summary

• The Password and Access Control Policy sets out specific responsibilities, conditions, and practices to minimize risks and protect physical assets and sensitive information.
• The policy applies to all systems and assets owned, managed, or operated by the organization.
• HR role/line managers inform IT of new employees, changes to access rights, and leavers.
• The Information Security Manager approves access requests and audits user and access lists quarterly.
• Systems administrators must adhere to the policy when making changes to access privileges and ensure systems enforce the configurations.
• User authentication is based on job classification and function, with access granted on a need-to-know basis.
• Access control systems must have a default "deny-all" setting.
• Non-authenticated and shared/group user IDs are prohibited.
• Every user must have a unique user ID and personal secret password.
• Authentication mechanisms must be appropriate for the delivery channel.
• Secure mechanisms for user authentication are required for operating systems, web applications, voice calls, email, faxes, and remote access.
• Access control configurations include unique passwords, password complexity requirements, password history, lockout settings, and two-factor authentication for remote access.

Note: The remaining sections of the document were not included in the text provided.