Access Control Policy

Access to systems and data is granted under least privilege. Role-based access control (RBAC) maps job functions to permission sets. Privileged accounts are unique, named, and separated from standard user accounts. Shared admin passwords are prohibited.

Managers review access rights quarterly. Privileged access is reviewed monthly by the security team. Terminations trigger same-day disablement of all accounts. Contractors receive time-bound access with automatic expiry.