What it has to decide
- The basis on which access is granted
Role based, attribute based, or request and approval. Pick one and say so. Most organisations run all three by accident and can describe none of them.
- Who approves, and who may not
Name the approver by role, and state plainly that a person may not approve their own access. Self-approval is the finding that closes deals.
- Privileged access, handled separately
Administrative access needs its own rules: separate accounts, no shared credentials, session recording or equivalent, and a shorter review cycle than standard access.
- Joiners, movers and leavers, with timeframes
Movers are the ones that fail. People change roles and accumulate the union of every role they have held. State that access is revoked on role change, not merely added to.
- Recertification, with a stated cadence and a consequence
Say how often access is reviewed, by whom, and what happens if a reviewer does not respond. A review with no consequence for silence is a review that returns approve-all.
- Authentication requirements, by system sensitivity
Where multi-factor authentication is mandatory, what counts as a factor, and which legacy exceptions exist with an expiry date against each.
How it is usually got wrong
- Leavers are handled well and movers are not, so long-serving staff hold the accumulated rights of every role they have ever had.
- Recertification is performed by a manager who cannot tell what the entitlement actually grants, so everything is approved.
- Service and machine accounts are out of scope by omission, and they are the accounts with the broadest rights and no owner.
- Break-glass accounts exist, are documented, and have never once triggered an alert on use.
- The policy mandates least privilege without defining who decides what is least.
Worked extract
What a decision looks like once it has been madeAccess is granted on the basis of a defined role. A role is requested by the individual's line manager and approved by the system owner. No individual may approve their own access request. Privileged access is granted to a separate named administrative account, never to a standard user account, and is reviewed every ninety days. Standard access is reviewed every one hundred and eighty days. Where a reviewer does not respond within fourteen days of a recertification request, the access under review is suspended rather than retained. On a change of role, all access associated with the previous role is revoked within five business days, independently of any access granted for the new role.
