Run the quarterly access review

Purpose

This Procedure describes how access to systems and customer environments is requested, approved, provisioned, reviewed, and withdrawn, so that the rules of the Access Control Policy work in daily practice.

Scope

It applies to every request for access to a Tidewell IT system, to production, and to a customer environment that we administer, whoever the requester is.

Roles

• Requester: the person who needs access, or the line manager acting for them.
• Line manager: confirms that the access fits the role.
• System owner: approves privileged access and access to customer environments.
• Service Desk Lead: owns this Procedure, provisions access, and runs the quarterly review.
• ISMS Manager: reviews every use of a break-glass account.

Procedure

Request and approval

1. The requester raises a request in the ticketing system. It names the system, the role needed, and the justification.
2. The line manager approves the request or rejects it with a reason. Nobody approves their own request.
3. For privileged access and for access to a customer environment, the system owner also approves.

Provisioning

1. The Service Desk provisions approved access within 2 working days, using the role templates wherever a template exists.
2. Privileged access goes to a separate privileged account, never to the daily account. Multi-factor authentication is enabled before the account is handed over.
3. Access to a customer environment is tied to the ticket and expires when the ticket closes. The expiry date is set at provisioning.
4. The Service Desk records what was granted, to whom, and on whose approval.

Quarterly review

1. Every quarter the Service Desk exports the access lists of production and customer environments.
2. Each system owner confirms or revokes every entry within 5 working days.
3. The Service Desk Lead files the signed-off export as Evidence on the review Task.

Revocation and break-glass

1. Access that the owner does not confirm is revoked within 5 working days. Leaver access ends by the end of the leaver's last working day, as the Joiner, Mover and Leaver Procedure describes.
2. A sealed break-glass account is used only when normal routes fail during an emergency. The user records the reason in the ticket and the account is sealed again afterwards.
3. The ISMS Manager reviews every break-glass use after the event, and the password is changed before the account is sealed.

Records

• The access request tickets with their approvals.
• The quarterly access review export with the decisions of the owners.
• The log of break-glass use and its review.

These records are kept with the other security records and are available to internal and external auditors.

Related documents

• Access Control Policy
• Joiner, Mover and Leaver Procedure
• Information Security Policy

Review

The Service Desk Lead reviews this Procedure at least once a year and after a significant change. The Procedure is also revised when a quarterly review shows that a step does not work.