44 lines
2.4 KiB
Markdown
44 lines
2.4 KiB
Markdown
# Access Control & Least Privilege Guidance
|
|
|
|
**Document owner:** [Owner/Role]
|
|
**Approved by:** [Steering Committee / CISO]
|
|
**Effective date:** [YYYY-MM-DD]
|
|
**Review cadence:** [Annually]
|
|
|
|
---
|
|
|
|
## 1. Purpose & Scope
|
|
Implementation guidance for the [Access Control & Least Privilege Policy](access_control_policy.md). Applies to IT/IAM, managers, and system/data owners.
|
|
|
|
---
|
|
|
|
## 2. Role Design — How To
|
|
- Start from job function, not from current access ("what does a Support Engineer need" not "what does Alice currently have" — the latter just codifies drift).
|
|
- Use Entra ID/Azure AD groups or equivalent RBAC roles; avoid direct resource ACLs for anything beyond a one-off, time-bound exception.
|
|
- Keep the number of distinct roles small — role sprawl is as bad as ad hoc grants; if two roles differ by one permission, question whether they should be one role with a scoped exception.
|
|
|
|
## 3. Joiner-Mover-Leaver — Practical Flow
|
|
1. **Joiner:** HR system triggers IAM provisioning workflow on start date; access live day 1, not requested ad hoc by the new hire's manager over chat.
|
|
2. **Mover:** Role change in HR system triggers automatic review — old role's access **removed**, not left "just in case."
|
|
3. **Leaver:** Termination in HR system triggers same-day deprovisioning; involuntary terminations trigger immediate (not end-of-day) revocation, coordinated with the immediate manager.
|
|
|
|
## 4. Access Review — Worked Example
|
|
| Account Type | Reviewer | What to Check |
|
|
|---|---|---|
|
|
| Privileged/Admin | Access Owner + manager | Still needed? Still least-privilege scoped? Any dormant admin sessions? |
|
|
| Standard User | Manager | Role still matches job function? Any accumulated ad hoc grants to fold into role or revoke? |
|
|
| Service Account | System owner | Still in use? Rotation current per [Secrets & Key Management Policy](secrets_management_policy.md)? |
|
|
|
|
## 5. Checklist
|
|
✅ Joiner-mover-leaver automated from HR system, not manual ticket-only.
|
|
✅ Privileged access reviewed quarterly, standard semi-annually.
|
|
✅ Separation-of-duties matrix documented for finance/production-deploy roles.
|
|
✅ Dormant accounts flagged per [Password Policy §2.11](password_policy_generic.md) (45-day inactivity).
|
|
✅ Ad hoc/direct grants logged and swept into the next access review.
|
|
|
|
---
|
|
|
|
## 6. References
|
|
- **[NIST SP 800-53 Rev. 5 (AC family)](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)**
|
|
- **[CIS Controls v8.1](https://www.cisecurity.org/controls/v8-1)**
|