Access rights
A.5.18
-
Last updated
Applicable
Catalog reference
Provision, review, modify, and revoke access rights in line with the organisation's access control policy. Reviews should happen periodically and on role change.
Narrative — how we satisfy this requirement
Access is requested through a ticket, approved by the system owner, and reviewed every quarter.
None due within 31 days.