Purpose
The purpose of this policy is to establish guidelines and procedures for granting and revoking access to Agile Co.'s information systems and data, in order to maintain the confidentiality, integrity, and availability of information.
Scope
This policy applies to all employees, contractors, vendors, and any other authorized users who access Agile Co.'s information systems and data.
Access Control Procedures
- Access to information systems and data will be granted based on the principle of least privilege, which means that users will only be given access to the resources they need to perform their job duties.
- Access control will be based on role-based access control (RBAC) and will be reviewed on a regular basis to ensure that access privileges are appropriate and up-to-date.
- Multi-factor authentication will be used to ensure that only authorized users are able to access information systems and data.
- Access to Agile Co.'s physical facilities will be controlled by using access control systems, such as electronic badges or biometric authentication, where appropriate.
- User accounts will be deactivated or deleted immediately upon termination of employment or contract.
- All users will be required to sign an agreement acknowledging their responsibilities regarding access to Agile Co.'s information systems and data.
- Users will be required to report any suspected or actual security incidents to the IT department immediately.