Access should be granted for a clear business need, limited to the minimum required level, and removed when the need ends.
Core principles
- Use named accounts wherever possible.
- Protect important accounts with strong authentication and MFA.
- Limit privileged access to authorised roles and controlled workflows.
- Review high-risk access on a defined schedule.
Joiner, mover, leaver controls
Document how Helixiora will:
- approve new access requests
- change access when responsibilities change
- remove access promptly when employment or engagement ends
Privileged access
For sensitive systems, define:
- which roles may hold privileged access
- how that access is approved
- how use is logged or reviewed
- how emergency or break-glass access is protected
Access reviews
List the systems that require periodic access review and the owner responsible for completing each review.