| File Reference : | P-89 User Access Management Policy |
| Date File Updated | 28-09-26 |
| Category | Policies | Tags: user access management policy, privileged access, least privilege, access reviews, Cyber Essentials |
Included in the alphaZ subscription
Every alphaZ document and toolkit, with updates as they are released. Everything you download is yours to keep.
You are logged in as an alphaZ subscriber
This document's file is ready to download from the Download Files tab below.
A user access management policy template covering unique IDs, privileged accounts, least privilege, access reviews and leavers, in plain language.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
Further guidance on access control:
Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.
This file is included in the alphaZ subscription.
If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
User Access Management Policy Template
A user access management policy template giving workers access to the information they need to carry out their responsibilities, while controlling access rights, privileged accounts and where information can be stored.
The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.
What the User Access Management Policy Covers
- Unique IDs - no generic or group IDs, with each user given their own
- Privileged access - administrator, super-user and root access restricted, controlled and not given by default
- Authorisation - privileged accounts only on written request from a senior manager, documented by the system owner
- Teams - privileged access not issued to entire teams
- Use of privileged accounts - for software installation and system reconfiguration only, not email or web browsing
- Least privilege and need to know - for physical and logical assets, with users understanding the sensitivity of their data
- Reviews and leavers - access reviewed regularly and on a change of role, and removed promptly when no longer needed
- Classification - users classify and store data using the information classification procedure
- Unmanaged storage - no personal cloud storage or removable storage without prior approval, and non-compliance reported
Checked Against Cyber Essentials
The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.
Using the Policy
Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.
Who Needs a User Access Management Policy?
Any organisation that manages user accounts on its systems, including those preparing for Cyber Essentials or ISO 27001.
Works with the Access Control Procedure
The PP-8-04 Access Control Policy Procedure sets out the procedure, the TT-8-08 Managing Users toolbox talk briefs staff, and the A-C_P46 Information Security Access Control audit checklist can be used to audit the arrangements.
Document Control
The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.
Related Policies
- P-24 Access Control Policy - access control
- P-27 Password Policy - passwords
- P-38 Software Installation Policy - software installation
Would you rather we prepared it for you?
Our Company Forms, Policies and HR Reset service prepares your policy set, staff handbook and HR forms as one branded set, tailored to how you actually run things.
These files are for alphaZ subscribers. Log in to the subscriber library once and each file below downloads straight away. Not a subscriber yet? See the alphaZ subscription.
Each file downloads straight away. You can also browse the subscriber library.
- P-89 User Access Management Policy Word, 31 KB
