Access Control Policy

Access Control Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

The purpose of this Policy is to protect, and reduce risk to, business operations by establishing requirements for creating, maintaining, and controlling access to information assets. This Policy ensures that both the information assets and the information in those assets are adequately protected against unauthorized access.

Scope

This Policy applies to all of Safire’s data regardless of whether that data is stored by Safire on-site or by a Third Party Service Provider in a hosted or cloud environment and to all Safire employees, including third parties, contractors, Third Party Service Providers, and anyone else who has, or may have, access to Safire’s data and Information Systems.

Policy

Access Control

Access to Safire’s Information Systems will be limited solely to users whose business needs, job functions, and responsibilities require such access, or to users on a need-to-know basis.

Only systems or devices that are authorized and approved by IT to connect to the system will be granted access.

Access requests must be approved by the user’s direct Manager and the Data Owner of the system. IT/System Administrators are responsible for provisioning access only upon receipt of proper approval.

The technical ability to create, delete, and modify user accounts is strictly limited to authorized System Administrators within the IT department.

Access reviews for all users and administrative access to Safire’s systems will be conducted periodically and, at a minimum, annually.

Reported discrepancies in permitted access will be remediated in a timely manner commensurate with the risk, or within 24 hours of discovery.

Granting and Removing User Access

Procedures for establishing, activating, modifying, reviewing, disabling, and removing accounts will be formally documented, implemented, and maintained by IT.

Whenever there is a change in a user’s employment status, that user’s access will be reviewed and removed or revised to ensure access is limited to only that needed for legitimate business purposes.

User access granted to third parties, including Third Party Service Providers and maintenance accounts, requires explicit approval from the CISO or Compliance. These accounts will be reviewed quarterly.

Guest/anonymous, shared/group, emergency, and temporary accounts must be specifically authorized by the CISO and monitored strictly.

Unnecessary accounts will be promptly removed, disabled, or otherwise secured.

Safire will require strong passwords for all user accounts consistent with NIST guidelines.

Inactive accounts will be disabled after 45 days of inactivity.

User access will be enabled only during the time period needed and disabled when an account is not in use.

When an account is in use, access will be monitored.

Users will be locked out after no more than 5 repeated access attempts.

Lockout duration will be for a minimum of 30 minutes or until such personnel as authorized by Safire re-enables the user ID.

Users must lock their device manually when leaving it unattended.

Sessions will automatically lock and a pattern-hiding display (for example, a screen saver) will activate after 15 minutes of inactivity.

Users will be required to re-authenticate to regain access to the session.

Users will not be permitted to use generic, shared, or service accounts to log in. The use of generic, shared, or service accounts by interactive users is prohibited unless explicitly authorized by the CISO as a documented exception.

Privileged Account Management (Administrative Access)

The allocation and use of Privileged Access to Safire’s Information Systems and services will be restricted and controlled.

Special attention shall be given to the allocation of Privileged Access rights, which allow users to override system controls.

Privileged user accounts will be separate from non-privileged user accounts and privileged user accounts will be used only when Privileged Access is required to complete a specific task or function.

All of a user’s Privileged Access to Safire’s Information Systems will be immediately revoked or revised as soon as that user’s change in employment status, job function, or responsibilities dictate that the user no longer requires such access.

No service account will be used by more than one service, application, or system.

Users with Privileged Access will not extend a user group’s permissions if such permissions would provide inappropriate access to any user in that group.

When technically feasible, all servers, applications, and network devices will contain a login banner that conveys the following:

• This computer and network are provided for use by authorized members of Safire.
• The use of this computer and network is subject to all applicable policies of Safire and any applicable laws and regulations.
• The use of this computer or network constitutes acknowledgment that the user is subject to all applicable policies of Safire, laws, and regulations.
• Any other use is prohibited.

Remote Access

Multi-Factor Authentication (MFA) will be required for all individuals using an external network to access Safire’s internal network.

Safire’s MFA will require the use of two authentication methods: first, a username and password or PIN combination, and second, a method not based on user credentials, such as a certificate or token, that Safire shall provision to the user.

All remote access communications to internal networks will be authenticated, encrypted, and monitored within a log. All encryption techniques must comply with the Acceptable Encryption Policy.

All machines used for remote access will have the latest anti-virus, security patches, and host-based firewall software installed, running, and enabled.

Third party access to Safire’s systems will be limited only to those specifically approved for valid business reasons.

The copying of data containing Nonpublic Information or other highly sensitive or Confidential Information to a user’s remote machine is prohibited unless such copying is necessary for business purposes, approved by a senior executive of Safire, and the copied data is encrypted at rest. All encryption techniques must comply with the Acceptable Encryption Policy.

Remote access will be disconnected automatically after 4 hours of inactivity and will require a user to re-authenticate to regain access.

Review of Access Rights

HR and Management are responsible for notifying IT of status changes such as promotion, transfer, or demotion. IT/Compliance will then review and adjust access rights to maintain Least Privilege.

System accounts will be reviewed annually, and any account that cannot be associated with a user or business process shall be disabled.

User accounts assigned to third parties that have access to restricted or confidential information will be reviewed quarterly and access rights updated to ensure that those accounts have access only to what is needed for legitimate business purposes.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions must be approved by the Policy Owner in advance.

No approved exceptions are listed in the source document.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• NIST Special Publication 800-63B, Section 10
• NIST Special Publication 800-171
• DFARS 252.204-7012
• Acceptable Encryption Policy
• Password Construction Policy
• Password Protection Policy

Referenced Terms

Privileged Access

An authorized user who has access to system control, monitoring, or administration functions, such as a System Administrator.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page