An access control policy template covering user accounts, system access, user responsibilities and data masking, with multi-factor authentication rules that match Cyber Essentials.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on access control:

• Access Control, Passwords and User Authentication
• Cybersecurity
• Information Classification and Protection
• Information Security knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This policy is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Access Control Policy Template

An access control policy template for controlling access to information and information processing equipment, with access granted on a least privilege basis and managed through user accounts that can each be identified.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Access Control Policy Covers

• Granting access - access to systems granted on a least privilege basis
• User account management - unique login details for every user, a register of user logins, and procedures for accounts when people join, move or leave
• Authentication - the user's identity verified before passwords or other authentication information are issued or reset, with that information kept confidential
• Multi-factor authentication - always used for cloud services, and for remote access and admin accounts wherever it is available
• System access - access to systems and secure areas controlled and reviewed, with access logged and monitored
• User responsibilities - following the policies on IT equipment, data protection and passwords, not sharing accounts, and reporting any suspected unauthorised access
• Data masking - protected fields masked, anonymised, encrypted or pseudonymised where required

Checked Against Cyber Essentials

The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.

Using the Policy

Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.

Who Needs an Access Control Policy?

Organisations working to ISO 27001, organisations applying for Cyber Essentials, and any organisation with systems holding confidential or personal information.

Included in the ISO 27001 Toolkit

This policy is part of the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers ISO 27001.

Works with the Access Control Procedure

The PP-8-04 Access Control Policy Procedure sets out how access is managed, and the same policy is included as the Access Control Policy section of the PP-8-100 Information Security Policy Procedure.

The PP-8-10 User Secret Authentication Policy Procedure covers passwords and other authentication information.

Document Control

The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.

Related Policies

• P-27 Password Policy - passwords
• P-89 User Access Management Policy - user access management
• P-114 Cyber Security Policy - cyber security
• P-31 Information Protection Policy - information protection
• P-102 Data Ownership Policy - data ownership