This policy procedure sets out how access to systems, information and premises is granted, reviewed and removed, and points to the register that records equipment and logins.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on access control:

• Access Control, Passwords and User Authentication
• ISO 27001 Annex A 5.15 - Access Control
• ISO 27001 Annex A 5.18 - Access Rights
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help setting up user access, starter and leaver controls, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Access Control Policy Procedure Template

The Access Control Policy Procedure is a Word template that sets out how a business controls access to information to prevent unauthorised access. It covers access risks, user accounts for new starters, leavers and role changes, physical access to premises, third party access, secret authentication, reviews of access rights, IT equipment and logins, and user responsibilities.

It applies to all employees and company activities, with disciplinary action for breaches. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of preventing unauthorised access to information, the activities and staff covered, and disciplinary action for breaches
• Management of access control risks - periodic risk assessments of access to information assets, with findings actioned and the policy kept in line with current controls
• User accounts and physical access - access granted, reviewed or deactivated for new starters, role changes and leavers, locked premises, escorted visitors and recorded office keys
• Access control for third parties - case by case approval of third party access, contractual agreements for the project or contract, and confidentiality agreements
• Secret authentication and access reviews - identity checks against personal file details, a pass code for higher security needs, and ongoing review of user access rights
• IT equipment, logins and user responsibilities - equipment identified with an owner, authenticated logins, reviewed event logs, logged third party system logins and no shared user accounts

Built for Controlled Access to Information

• Access permissions reviewed for new starters, deactivated for leavers and checked when someone changes role
• Visitors escorted and accompanied at all times on the premises
• Confidentiality agreements required for third parties who access confidential information
• Event logs of user activity reviewed on an ongoing basis and retained for future use
• Logins to company and third party systems holding company information logged

Who Needs an Access Control Policy Procedure?

Any business that needs to control who can reach its systems, information and premises, including those that give third parties access to internal systems.

How the Policy Fits Together

Office keys, IT equipment and logins are recorded on ER10 IT Equipment Logins Register, and staff keep desks and screens clear in line with P-23 Clear Desk Clear Screen Policy.

Using the Policy

Edit the starter, leaver and role change steps, visitor arrangements and identity check details to match your own, and name the person in the Controlled By field. Give it top level approval and brief staff on their user responsibilities.

Related Documents

GG-8-04 Access Control and User Authentication Guidance and TT-8-04 Access Control and User Authentication Training Talk help managers and staff put access controls into practice.

Checking Identity Before Sharing Information

Where the identity of a member of staff or other personnel needs to be validated, the policy uses details already held on their personal file, such as date of birth or postcode. For higher security requirements, a pass code is set up and retained for that person.