Access Control Policy
Defines access rules, approval, least privilege, and review cadence.
Rules for data ownership, quality, lifecycle, and stewardship.
Description
Establishes how data is owned, managed, protected, and used across its lifecycle. Covers data ownership/stewardship, data quality standards, classification, access rules, retention/disposal, permitted uses, data sharing, and alignment with privacy and security requirements.
Defines access rules, approval, least privilege, and review cadence.
Establishes governance structure, decision rights, and oversight.
Sets risk principles, controls expectations, and accountability for AI.
Controls for asset inventory, ownership, and protection.
Defines approvals and safeguards for system/process change.
Backup requirements, testing cadence, and recovery expectations.