Access Control Policy
Defines access rules, approval, least privilege, and review cadence.
Sets standards for vendor risk management and oversight.
Description
Defines how vendors and third parties are evaluated, approved, monitored, and offboarded. Covers risk tiering, due diligence requirements, contract/security requirements, data handling expectations, ongoing monitoring, incident notification requirements, and termination/offboarding controls.
Defines access rules, approval, least privilege, and review cadence.
Establishes governance structure, decision rights, and oversight.
Sets risk principles, controls expectations, and accountability for AI.
Controls for asset inventory, ownership, and protection.
Defines approvals and safeguards for system/process change.
Backup requirements, testing cadence, and recovery expectations.