AC-1 Access control policy and procedures
Requires an access control policy and supporting procedures to be written, approved, issued to the personnel who must apply them, owned by a named official, and reviewed and reissued on a defined frequency and after defi
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Review log showing the last review against the defined frequency and any event-driven review · Identity provider / directory
governing documentDocuments that govern the control
- Approved access control policy showing issue date, approver and stated scope · Policy repository / GRC workspace
- Distribution or acknowledgement record proving the policy reached the defined audience · Policy repository / GRC workspace
- Written designation of the official accountable for the policy and its procedures · Policy repository / GRC workspace
- Access control procedure documents that operationalise each policy statement · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Policy exists but the review frequency and triggering events were never defined, so no review is ever due
- Procedures describe an older toolset and no longer match how access is actually granted
- No named official owns the policy, so updates stall between security and IT operations
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet