Access Control Policy
Defines how Your Organization grants, reviews, and revokes access to information systems — codifying least privilege, RBAC, privileged account rules, and quarterly access review cadence.
Maps to ISO/IEC 27001:2022 A.5.15 · FedRAMP Moderate AC-2
Read it now — the PDF opens either way.
Purpose
Granting the right access to the right people at the right time — and no more — is foundational to protecting Your Organization information. This policy defines the principles, roles, and processes Your Organization uses to grant, review, and revoke access to its information systems and data.
Scope
This policy applies to all Your Organization information systems, applications, and data stores, including cloud services, SaaS tools, developer infrastructure, network devices, databases, and physical access systems. It applies to all workforce members, contractors, and third-party users.
9 more sections in the full template
Principles · Roles and responsibilities · Account lifecycle · Privileged access · Service accounts · Access reviews · Remote and vendor access · Scope exceptions · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Access Control Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.