ISO 27001:2022 Access Control & Password Policy Template

# Access Control & Password Policy (ACP-02) **Classification:** Internal / Auditor-Accessible **Controls Mapped:** ISO/IEC 27001:2022 A.5.15, A.5.16, A.5.17 | SOC 2 CC6.1-CC6.3 --- ## 1. Purpose & Scope This policy defines the access management standards enforced across all corporate systems, cloud infrastructure, source code repositories, and identity providers to prevent unauthorized access and credential abuse. ## 2. Core Principles - **Least Privilege:** Users are granted the minimum level of access necessary for their job role. - **Segregation of Duties:** Production deployment rights are segregated from daily engineering write access. ## 3. Multi-Factor Authentication (MFA) 1. MFA is **mandatory for 100% of workforce accounts** across all platforms. 2. Permitted methods: Hardware security keys (WebAuthn/FIDO2) or TOTP authenticator apps. SMS-based 2FA is prohibited. ## 4. Password Standards - Minimum master password length: **16 characters** with combined character classes. - Use of managed password vaults is mandatory. Plaintext storage of secrets is strictly prohibited. ## 5. Offboarding Access Revocation SLA Upon employment termination or contractor offboarding, all system credentials, SSO sessions, and repository permissions must be revoked within **4 hours**.