Access Control Policy

Document owner: Chief Information Security Officer (CISO) Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual, and upon material changes to access control architecture or regulatory requirements Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

---

Definitions

Term	Definition
Access Control	Security technique regulating who can view or use resources
Authentication	Process of verifying the identity of a user, process, or device
Authorization	Process of granting or denying access to a specific resource
ABAC	Attribute-Based Access Control, access decisions based on attributes
CRUD	Create, Read, Update, Delete - standard data operations
DAC	Discretionary Access Control, owner-determined access permissions
Entitlement	A right or permission granted to a user or system
FIDO2	Fast Identity Online 2, passwordless authentication standard
IAM	Identity and Access Management, framework for managing digital identities
IdP	Identity Provider, system managing user identities and authentication
JIT	Just-in-Time, access provisioning when needed for limited duration
Joiner-Mover-Leaver	Lifecycle events for access management
Least Privilege	Providing minimum access necessary to perform duties
MAC	Mandatory Access Control, system-enforced access restrictions
MFA	Multi-Factor Authentication, requiring multiple verification methods
Need-to-Know	Restricting access to information necessary for job function
PAM	Privileged Access Management, controlling elevated access
PBAC	Policy-Based Access Control, rule-driven access decisions
Privilege Escalation	Obtaining higher access than initially authorized
RBAC	Role-Based Access Control, access based on organizational roles
SCIM	System for Cross-domain Identity Management, user provisioning protocol
Separation of Duties	Dividing critical tasks among multiple people
Service Account	Non-human account for automated processes
SSO	Single Sign-On, one authentication for multiple applications
Step-up Authentication	Additional verification for sensitive operations
TOTP	Time-based One-Time Password, MFA method using time-synchronized codes
WebAuthn	Web Authentication API, browser standard for FIDO2
Zero Trust	Security model requiring verification for all access attempts

---

Scope and Applicability

1.1 Policy Scope

This Access Control Policy applies to all access to Acme Cloud, Inc. ("Acme Cloud") information systems, including:

Scope Area	Coverage	Examples
Production systems	Full policy	SaaS platform, databases, infrastructure
Staging environments	Full policy (with customer data)	Pre-production validation
Development systems	Partial policy	Development environments, CI/CD
Corporate systems	Full policy	Google Workspace, Slack, HR systems
Physical facilities	Physical access sections	Offices, data centers
Customer systems	Customer-facing features	Customer authentication, authorization

1.2 Personnel Scope

Personnel Type	Policy Application	Exceptions
Full-time employees	Full policy	None
Part-time employees	Full policy	None
Contractors	Full policy + sponsor accountability	Time-bound access
Consultants	Limited policy per engagement	Project-specific access
Temporary workers	Limited policy	Time-bound, no privileged access
Vendors (on-site)	Physical access only	Escorted access
Customers	Customer access features	Self-service management

1.3 System Classification

Classification	Access Requirements	Examples
Critical	Privileged access process, MFA required, audit logging, approval required	Production databases, encryption keys
High	Standard access process, MFA required, audit logging	Production application, customer support tools
Medium	Standard access process, MFA recommended	Internal wikis, project management
Low	Self-service access, basic authentication	Public documentation

---

Access Control Principles

2.1 Foundational Principles

Acme Cloud access control is built on the following principles:

Principle	Definition	Implementation
Least Privilege	Grant minimum access necessary	Role-based access, regular reviews
Need-to-Know	Restrict information to those who require it	Data classification, access controls
Separation of Duties	Divide critical functions	Approval workflows, dual control
Defense in Depth	Multiple layers of controls	MFA, network segmentation, monitoring
Zero Trust	Verify explicitly, assume breach	Continuous verification, microsegmentation
Accountability	Every access traceable to individual	Audit logging, no shared accounts

2.2 Zero Trust Architecture

Acme Cloud implements Zero Trust principles:

ZTA Tenet	Implementation	Verification
Verify explicitly	Authenticate every request	Session validation, token verification
Use least privilege	JIT access, time-limited permissions	Access reviews, automatic expiration
Assume breach	Defense in depth, monitoring	SIEM, anomaly detection
Inspect and log all traffic	Network monitoring, API logging	VPC flow logs, API audit logs
Encrypt everything	TLS everywhere, encryption at rest	Certificate management, KMS
Segment networks	VPC isolation, microsegmentation	Network architecture review

2.3 Access Control Models

Model	Application	Scope
RBAC (Role-Based)	Primary model for most access	All systems
ABAC (Attribute-Based)	Context-aware decisions	Production access, sensitive data
PBAC (Policy-Based)	Complex authorization rules	Multi-tenant isolation
DAC (Discretionary)	Limited to specific data sharing	Customer-configured sharing

---

Identity Management

3.1 Identity Providers

Identity Provider	Population	Use Case
Okta	Acme Cloud workforce	Corporate SSO, workforce authentication
Acme Cloud Platform	Customers	Customer authentication
Customer IdP (SAML/OIDC)	Customer end users	Federated authentication
AWS IAM	Infrastructure	Service authentication
GitHub	Developers	Code repository access

3.2 Account Types

Account Type	Description	Lifecycle	MFA Requirement
User Account	Individual human identity	Joiner-mover-leaver	Required
Admin Account	Elevated privileges	Separate from user account	Required (FIDO2)
Service Account	Automated process identity	Change-controlled	N/A (API keys)
System Account	Infrastructure identity	Infrastructure-as-code	N/A (IAM roles)
Emergency Account	Break-glass access	Sealed, audited	Required
Shared Account	Prohibited	N/A	N/A

3.3 Account Naming Standards

Account Type	Naming Convention	Examples
User accounts	firstname.lastname@acmecloud.com	john.smith@acmecloud.com
Admin accounts	firstname.lastname-admin@acmecloud.com	john.smith-admin@acmecloud.com
Service accounts	svc-{service}-{function}@acmecloud.com	svc-billing-processor@acmecloud.com
System accounts	sys-{system}-{environment}	sys-terraform-prod

3.4 Identity Lifecycle Management

Joiner Process (New Employee)

Step	Action	Timeline	Owner
1	HR creates identity record	Pre-start date	HR
2	Manager submits access request	5 days before start	Manager
3	Baseline access provisioned	Start date	IT Operations
4	Security training assigned	Day 1	Security Training
5	Role-specific access granted	After training completion	System owners

Mover Process (Role Change)

Step	Action	Timeline	Owner
1	HR updates role in system	Upon transfer	HR
2	New manager requests new access	5 days before transfer	New manager
3	Old access flagged for review	Transfer date	Automated
4	Access review with old manager	Within 5 days	Old manager
5	Unnecessary access removed	Within 10 days	IT Operations

Leaver Process (Termination)

Step	Action	Timeline	Owner
1	HR initiates termination	Before last day (voluntary) / Immediately (involuntary)	HR
2	Access suspended	Within 4 hours / Immediately	IT Operations
3	Manager validates data transfer	Within 24 hours	Manager
4	Account disabled	After data transfer	IT Operations
5	Account deleted	30 days after termination	Automated

---

Authentication Requirements

4.1 Password Policy

Requirement	Standard	Privileged
Minimum length	14 characters	16 characters
Complexity	Mixed case + numbers + symbols	Mixed case + numbers + symbols
Maximum age	365 days	180 days
History	12 passwords	24 passwords
Lockout threshold	10 failed attempts	5 failed attempts
Lockout duration	30 minutes	Manual unlock required
Breach database check	Required	Required

4.2 Multi-Factor Authentication

MFA Method	Security Level	Approved For	Phishing Resistant
FIDO2/WebAuthn	Highest	All access, required for privileged	Yes
Okta Verify Push	High	All access	Partial (number matching)
TOTP (authenticator app)	Medium	Fallback only	No
SMS	Low	Not approved	No
Email OTP	Low	Not approved	No

MFA Requirements by Access Type:

Access Type	MFA Required	Approved Methods
Corporate SSO	Yes	FIDO2, Okta Verify, TOTP
Production access	Yes	FIDO2 required
Customer account (admin)	Yes	FIDO2, Authenticator app
Customer account (user)	Configurable	Per customer policy
API access	Token-based	API keys, OAuth 2.0

4.3 Session Management

Parameter	Standard Session	Privileged Session
Maximum duration	12 hours	4 hours
Idle timeout	30 minutes	15 minutes
Concurrent sessions	Limited per policy	Single session
Re-authentication	Sensitive actions	All actions
Session binding	Device + IP range	Device + IP + geolocation

4.4 Authentication Logging

Event	Logged Data	Retention
Successful login	User, timestamp, IP, device, method	2 years
Failed login	User (if known), timestamp, IP, reason	2 years
MFA challenge	User, method, result, timestamp	2 years
Password change	User, timestamp, IP	7 years
Account lockout	User, timestamp, reason	2 years
Session termination	User, timestamp, reason	2 years

---

Authorization Framework

5.1 Role-Based Access Control (RBAC)

Acme Cloud implements hierarchical RBAC:

Role Level	Description	Example Roles
Global roles	Organization-wide permissions	Admin, Security, Compliance
Department roles	Department-specific access	Engineering, Sales, Support
Project roles	Project-specific access	Project Owner, Contributor, Viewer
Resource roles	Individual resource access	Document Owner, Reviewer

5.2 Standard Role Definitions

Role	Description	Permissions	Assignment
Employee	Base corporate access	Email, chat, wiki, HR systems	Automatic on hire
Developer	Engineering team member	Code repos, CI/CD, dev environments	Engineering manager
Support Agent	Customer support	Support tools, read-only customer data	Support manager
Account Executive	Sales team	CRM, prospecting tools	Sales manager
System Administrator	Infrastructure management	Infrastructure admin, production read	IT director + CISO
Security Analyst	Security operations	Security tools, log access	CISO
Database Administrator	Database management	Database admin (specific DBs)	CTO + CISO
Super Admin	Maximum privilege	All systems	CEO + CISO approval

5.3 Role Assignment Process

Step 1: Access Request 1.1. User or manager submits access request 1.2. Request includes: role requested, business justification, duration 1.3. System validates requestor authorization

Step 2: Approval Workflow

Access Level	Approval Chain
Standard	Manager
Elevated	Manager + Data/System Owner
Privileged	Manager + Data/System Owner + Security
Super Admin	Manager + CISO + CEO

Step 3: Provisioning 3.1. Approved request triggers provisioning 3.2. Access granted per role definition 3.3. User notified of new access 3.4. Access logged for audit

5.4 Permission Matrix

Permission Type	Description	Examples
Read	View data/resource	View reports, read documents
Create	Generate new data/resource	Create tickets, upload files
Update	Modify existing data/resource	Edit configurations, update records
Delete	Remove data/resource	Delete files, archive records
Admin	Full control including permissions	Manage users, configure settings
Execute	Run operations/processes	Trigger workflows, run reports

---

Privileged Access Management

6.1 Privileged Access Definition

Privilege Level	Definition	Examples
Level 1 - Standard	Normal business operations	Email, documents, collaboration
Level 2 - Elevated	Access to sensitive data	Customer data, financial records
Level 3 - Privileged	Administrative capabilities	System configuration, user management
Level 4 - Super Privileged	Maximum access	Infrastructure admin, security admin

6.2 Just-in-Time (JIT) Access

All privileged access follows JIT principles:

JIT Parameter	Standard Privileged	Emergency Access
Request required	Yes	Post-incident documentation
Approval required	Yes (within 4 hours)	Pre-approved for named individuals
Maximum duration	8 hours	As needed (reviewed within 24 hours)
Automatic expiration	Yes	Yes
Session recording	Yes	Yes
Extension process	New request required	Documented justification

6.3 Privileged Access Workflow

Standard Privileged Access Request:

Step	Action	Timeline	SLA
1	Submit request via PAM tool	User-initiated	N/A
2	System validates entitlement	Automatic	Immediate
3	Route to approver(s)	Automatic	Immediate
4	Approver reviews and decides	Approver action	4 hours
5	If approved, credentials provisioned	Automatic	5 minutes
6	User accesses system (recorded)	User action	N/A
7	Access auto-expires	Automatic	Per request
8	Session logs archived	Automatic	Immediate

6.4 Break-Glass Procedures

Emergency access when normal procedures cannot be followed:

Step	Action	Verification
1	Retrieve sealed emergency credentials	Two-person rule
2	Access system	Session recorded
3	Perform emergency actions	Audit logged
4	Exit and reseal credentials	Two-person verification
5	Incident report within 24 hours	Security review
6	Post-incident review	CISO review

6.5 Service Account Management

Requirement	Implementation	Verification
Unique identity	One account per service/function	Naming convention
No interactive login	Programmatic access only	Account type
Secrets in vault	AWS Secrets Manager	Configuration audit
Automated rotation	90-day rotation	Rotation logs
Owner assigned	Documented ownership	CMDB record
Access review	Quarterly	Review records

---

Access Reviews and Recertification

7.1 Review Schedule

Review Type	Scope	Frequency	Reviewer
Privileged access	All privileged accounts	Monthly	CISO or delegate
Production access	Production system access	Monthly	Security Operations
Application access	Business applications	Quarterly	Application owners
Role membership	RBAC role assignments	Quarterly	Managers
Service accounts	Automated account permissions	Quarterly	Service owners
Contractor access	All contractor accounts	Monthly	Sponsors
Dormant accounts	Inactive > 30 days	Monthly	Automated + Security

7.2 Access Review Process

Step 1: Review Initiation 1.1. System generates access review campaign 1.2. Reviewers notified via email 1.3. Review dashboard populated with entitlements

Step 2: Reviewer Actions 2.1. Reviewer examines each entitlement 2.2. For each: Certify (approve) or Revoke (remove) 2.3. Justification required for certifications

Step 3: Remediation 3.1. Revoked access removed within SLA 3.2. Incomplete reviews escalated 3.3. Completion reported to management

7.3 Review SLAs

Review Type	Completion SLA	Escalation Trigger	Remediation SLA
Privileged access	5 business days	Day 3	Same day
Production access	7 business days	Day 5	2 business days
Application access	10 business days	Day 7	5 business days
Dormant accounts	5 business days	Day 3	Same day

7.4 Access Review Metrics

Metric	Target	FY2025 Actual
Review completion rate	100%	100%
On-time completion	100%	97.3%
Revocation rate	N/A (informational)	8.2%
Escalation rate	< 10%	2.8%
Remediation SLA adherence	100%	99.1%

---

Customer Access Control Features

8.1 Customer Authentication Options

Feature	Free	Professional	Enterprise
Username/password	Yes	Yes	Yes
MFA (TOTP)	Yes	Yes	Yes
MFA (FIDO2)	Yes	Yes	Yes
SSO (SAML 2.0)	No	Yes	Yes
SSO (OIDC)	No	Yes	Yes
Custom MFA policy	No	Basic	Full
Password policy customization	No	Limited	Full

8.2 Customer Authorization Features

Feature	Free	Professional	Enterprise
Role-based access	Basic (3 roles)	Standard (10 roles)	Custom roles
Team/group management	No	Yes	Yes
Permission customization	No	Limited	Full
API access controls	Basic	Standard	Advanced
IP allowlisting	No	No	Yes
Time-based access	No	No	Yes

8.3 Customer SSO Integration

SSO Component	Support Level	Documentation
SAML 2.0	Full support	docs.acmecloud.com/sso/saml
OIDC	Full support	docs.acmecloud.com/sso/oidc
JIT provisioning	Supported	Included with SSO
SCIM provisioning	Enterprise only	docs.acmecloud.com/scim
Group mapping	Enterprise only	Custom configuration
MFA passthrough	Supported	IdP-controlled

8.4 Customer Audit Logs

Event Type	Free Retention	Professional Retention	Enterprise Retention
Authentication events	7 days	90 days	1 year + export
Authorization events	7 days	90 days	1 year + export
Configuration changes	7 days	90 days	1 year + export
Data access	Not available	90 days	1 year + export
Admin actions	7 days	90 days	1 year + export

---

Monitoring and Enforcement

9.1 Access Monitoring

Monitoring Type	Scope	Alert Threshold	Response
Failed authentication	All systems	5 failures in 10 minutes	Account lockout, investigation
Impossible travel	SSO logins	Login from distant location	Step-up auth, investigation
Privilege escalation	Production systems	Any unauthorized attempt	Block, immediate investigation
Off-hours access	Critical systems	Access outside business hours	Alert, verification required
Unusual data access	Customer data	Volume anomaly	Alert, investigation
Service account abuse	Automated accounts	Interactive login attempt	Block, investigation

9.2 Access Anomaly Detection

Anomaly Type	Detection Method	Response
Location anomaly	Geolocation comparison	Challenge, step-up auth
Device anomaly	Device fingerprinting	Challenge, notification
Behavior anomaly	ML-based baseline	Alert, investigation
Time anomaly	Historical pattern	Challenge, logging
Volume anomaly	Statistical threshold	Alert, rate limiting

9.3 Enforcement Actions

Violation Type	Automated Response	Manual Follow-up
Policy violation	Access blocked	Investigation, remediation
Suspicious activity	Step-up authentication	Security review
Confirmed compromise	Account suspended	Incident response
Privilege abuse	Access revoked	HR involvement
Repeated violations	Escalating restrictions	Management escalation

---

Compliance and Exceptions

10.1 Policy Exceptions

Exception requests must include:

Element	Requirement
Business justification	Why standard policy cannot be followed
Risk assessment	Risks introduced by exception
Compensating controls	Additional controls to mitigate risk
Duration	Time-limited (maximum 1 year)
Review date	When exception will be re-evaluated
Approval	CISO approval required

10.2 Exception Approval Matrix

Exception Type	Approval Required	Maximum Duration
MFA bypass	CISO	30 days
Password policy exception	Security Manager	90 days
Privileged access duration	CISO	Per incident
Shared account	Not approved	N/A
Access review extension	Security Manager	5 business days

---

Framework Mapping Appendix

SOC 2 Trust Services Criteria Mapping

TSC	Control	Acme Cloud Implementation	Evidence
CC6.1	Logical access security	Identity management, authentication	IAM configurations
CC6.2	Access provisioning	JML process, approval workflows	Provisioning records
CC6.3	Access removal	Offboarding process	Termination records
CC6.4	Access restriction	RBAC, least privilege	Role definitions
CC6.5	Privileged access	PAM, JIT access	PAM logs
CC6.6	Access reviews	Periodic recertification	Review records
CC6.7	Physical access	Badge access, visitor management	Access logs
CC6.8	System account management	Service account controls	Account inventory

ISO 27001 Annex A Mapping

Control	Acme Cloud Implementation	Evidence
A.9.1.1	Access control policy	This document
A.9.1.2	Network access control	VPC segmentation, firewall rules
A.9.2.1	User registration	JML process
A.9.2.2	Access provisioning	Role-based provisioning
A.9.2.3	Privileged access	PAM system
A.9.2.4	Secret management	Secrets Manager, rotation
A.9.2.5	Access review	Periodic certification
A.9.2.6	Access removal	Offboarding process
A.9.3.1	Secret information use	Password policy, MFA
A.9.4.1	Access restriction	Need-to-know, least privilege
A.9.4.2	Secure log-on	MFA, session controls
A.9.4.3	Password management	Policy enforcement
A.9.4.4	Privileged utilities	Admin tool controls
A.9.4.5	Source code access	Repository permissions

NIST CSF Mapping

NIST Function	Category	Acme Cloud Implementation
Identify (ID)	ID.AM	Asset inventory, account inventory
Protect (PR)	PR.AC-1	Identity management
Protect (PR)	PR.AC-2	Physical access control
Protect (PR)	PR.AC-3	Remote access management
Protect (PR)	PR.AC-4	Access permissions management
Protect (PR)	PR.AC-5	Network integrity
Protect (PR)	PR.AC-6	Identity proofing
Protect (PR)	PR.AC-7	Authentication
Detect (DE)	DE.CM-3	Access monitoring
Respond (RS)	RS.MI-2	Access incident response

---

Related Trust Center documents

security overview, encryption standards, incident response, data retention, privacy policy, terms of service

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices