Access Control Policy
1Purpose
This policy sets the rules for granting, using, reviewing and revoking access to Acme Defense Systems information systems, including the CUI enclave, so that only authorized users, processes and devices can reach them.
2Scope
Applies to all employees, contractors and third parties who access Acme systems, and to every system in the CUI enclave (engineering file shares, NX workstations, Microsoft 365 GCC High) and the corporate network.
3Roles and responsibilities
Responsibilities are assigned as follows. The table is generated from the Teams directory and updates when owners change.
| CISO | DWDana Whitfield | Owns this policy; approves exceptions |
| IT Operations Lead | TOTom Okafor | Provisions, reviews and revokes access |
| Compliance Manager | MLMarcus Lee | Monitors reviews; reports to management |
| HR Director | SASofia Alvarez | Triggers joiner / mover / leaver events |
4Policy statements
The following statements are mandatory.
4.1Account management
Accounts are requested through the service desk, approved by the asset owner and provisioned per PRC-011. Shared accounts are prohibited except for documented break-glass accounts held in the vault.
4.2Least privilege
Users receive the minimum access needed for their role. Privileged access is granted to named administrator accounts separate from day-to-day accounts.
4.3Multifactor authentication
MFA is required for all network access and for local and network access to privileged accounts, including console logons to servers in the CUI enclave.
Phishing-resistant authenticators (FIDO2) are required for administrators. SMS codes are not an approved factor.
Should this name the 4 legacy servers, or keep it generic? Auditors asked about 3.5.3[b].
4.4Remote access
Remote access is permitted only through the managed VPN with device posture checks. Sessions are logged and monitored by the SOC.
4.5Access reviews
Asset owners review user access to CUI systems quarterly and privileged access monthly. Reviews are signed off in AegisERM; email sign-off is not accepted as evidence.
5Requirements addressed
This policy implements the controls below. Status is live from the Controls register.
6Exceptions
Exceptions require a documented risk acceptance approved by the CISO, with compensating controls and an expiry no longer than 12 months.
7Enforcement
Violations may lead to removal of access and disciplinary action up to termination, and may be reported to the contracting officer where CUI is involved.