1. Purpose

To establish a formal process for granting, modifying, and revoking access rights to information systems and data assets across the organisation.

2. Scope

This procedure applies to all employees, contractors, and third parties who require access to company systems, applications, and data.

3. Access Provisioning

All access requests must be initiated via the IT service desk portal and approved by the line manager and the system owner. Privileged access requires additional CISO sign-off.

4. Quarterly Review

A mandatory quarterly review of all privileged accounts must be performed by the IT Operations team. Any accounts with no activity in 60 days are suspended pending review...