Procedure
Access Control Procedure
This procedure defines the processes for granting, reviewing, modifying, and revoking access to organizational systems, applications, data, and network resources. It implements the principle of least privilege and need-to-know access model across all platforms, ensuring access is appropriate, authorized, and periodically reviewed.
- Type
- Procedure
- Version
- 1.4.1
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material system or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- Purpose
- Scope
- Roles and responsibilities
- 1. Access request and approval
- 2. Access provisioning
- 3. Access review
- 4. Access modification
- 5. Access revocation
- 6. Privileged access management
- 7. Third-party and vendor access
- Framework alignment
Frameworks it maps to
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO/IEC 29146:2024
- NIST SP 800-53 Rev. 5
- COBIT 2019
- CSA CCM v4.1
- NIST SP 800-207
- CISA Zero Trust Maturity Model v2.0 (April 2023)
- ISO/IEC 27017:2026
- ISO/IEC 27036-2:2022
- Canada CCCS Baseline Cyber Security Controls for Small and Medium Organizations V1.2
- Canada TBS Directive on Security Management (federal public sector)
Related documents
- Identity Management Proceduresecurity
- IT Onboarding and Offboarding Proceduresecurity
- Security Incident Response Proceduresecurity
- Enterprise Governance and Risk Management Policyrisk
- Risk Assessment Methodology Procedurerisk
- Emergency Authority Standardgovernance
Next
All Documents