1. Purpose
To establish guidelines for controlling access to the organization’s systems, data and technology resources, ensuring access is granted based on the principle of least privilege and business need.
2. Scope
This policy applies to all employees, third parties, partners and service providers who have access to the organization’s systems, information and technology assets.
3. General Guidelines
3.1 Principle of Least Privilege
Access to systems and data must be granted exclusively according to the user’s role and limited to the minimum necessary to perform their duties.
3.2 Granting Access
- All access must be formally requested and approved by the responsible manager.
- Access rights must be linked to the user’s role.
- Third-party access must have a defined expiration date.
3.3 Access Reviews
- Access privileges must be reviewed at least once a year.
- Additional reviews must take place when a role changes or employment ends.
- When an employee leaves, access must be revoked immediately.
3.4 Monitoring and Logs
- Systems must maintain access logs.
- Logs must be stored in accordance with the company’s retention policy.
- Suspicious events must be analyzed by the responsible department.
3.5 Authentication
- The use of individual, non-transferable credentials is mandatory.
- Wherever applicable, multifactor authentication (MFA) must be used.
- Passwords must meet the minimum requirements defined in the Information Security Policy.
4. Responsibilities
- Managers: Approve and review access for their teams.
- IT/Security: Implement technical controls, maintain records and conduct periodic reviews.
- Users: Use access responsibly and do not share credentials.
5. Disciplinary Measures
Failure to comply with this policy may result in disciplinary measures in accordance with the organization’s internal rules.
6. Effective Date
This policy takes effect on its publication date and must be reviewed annually.