Policy 07 — Access Control Policy

← All 21 policies

This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 07. Values shown as [X] are placeholders still to be set.

Purpose

To ensure access to systems and data is granted strictly on business need-to-know and least privilege, and is reviewed regularly.

Scope

Applies to all Revique systems, applications, databases, and data stores containing CHD/PHI.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Access must be granted on the principle of least privilege and business need-to-know.

2All access must default to deny; access is granted only by explicit authorization.

3Access rights must be reviewed at least every [X] months and revoked when no longer required.

4Privileged/administrative access must be restricted to authorized personnel and logged.

5Access must be revoked immediately upon termination or role change.

Roles & responsibilities

Role	Responsibility
Security Officer	Approve, review, and audit access rights.
DevOps / IT	Implement and revoke access per authorization.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→