Access Control Policy

Purpose

This policy explains how access to SOC and Data Center systems and physical spaces is managed. Its goal is to ensure that only authorized individuals have the appropriate level of access needed for their job responsibilities, protecting system security and operational integrity.

Scope

Applies to:

• Employees
• Interns
• Contractors
• Third-party workers
• Anyone granted access to SOC or data center resources

Covers:

• Physical access: Entering secure SOC or Data Center areas
• Digital access: Logging into systems, networks, tools, or operational platforms

Policy Rules

1. Principle of Least Privilege

Everyone must receive only the minimum access required to perform their job — no additional permissions.

2. Access Based on Job Role

Access levels depend on assigned roles, such as:

• SOC Analysts
• System Administrators
• Network Administrators
• Security Engineers
• Data Center Operations Staff
• Management

3. Secure Login Requirements

All users must follow secure authentication standards:

• MFA required for administrative and remote access
• Strong passwords required
• Default passwords must be changed immediately
• No shared accounts permitted

4. Admin / Privileged Accounts

Privileged accounts must:

• Be assigned to a single user (no shared or generic admin logins)
• Be used only for administrative tasks
• Have logging and monitoring enabled at all times

5. Physical Access Control

To enter SOC or Data Center secure areas:

• Badge access is required
• Secondary authentication (PIN or biometric) required
• Visitors must be escorted at all times
• Visitor access must be logged and monitored

6. Remote Access Rules

Remote access is only allowed using:

• Approved VPN
• Encrypted connections
• Approved and compliant devices
• Up-to-date cipher suites

Personal devices may not be used unless an approved exception is granted.

7. Logging and Monitoring

We log and monitor:

• Badge-swipe entry events
• System login attempts
• Account and permission changes
• Folder or data access
• System configuration changes

Suspicious access attempts must immediately generate SOC alerts.

8. Reviewing Access

Access permissions are reviewed:

• Every 6 months for standard users
• Every 3 months for admin-level users
• Whenever someone changes roles or departments
• Immediately upon departure from the organization

9. Handling Unauthorized Access

If unauthorized access occurs:

1. Access is disabled immediately
2. Security team begins investigation
3. Logs and relevant evidence are reviewed
4. Management is notified

10. Consequences for Violations

Possible consequences include:

• Loss of access rights
• Academic or internal disciplinary action

11. Exceptions

Exceptions must:

• Be formally documented
• Include a valid justification
• Be approved by SOC management

12. Policy Updates

This policy is reviewed annually or whenever major changes occur in systems, roles, or security requirements.