Skip to main content

User Access and Account Management Policy

Purpose​

The User Access and Account Management Policy establishes a standardized framework for managing user identities, credentials, and access rights across RS Tech Services’ information systems and client environments.

The purpose of this policy is to ensure that access to systems and data is granted based on business necessity, maintained securely, and revoked promptly upon role change or termination.

By implementing consistent account management controls, including authentication, authorization, and periodic access reviews, RS Tech Services aims to minimize the risk of unauthorized access, data breaches, and insider threats while supporting compliance with ISO 27001, NIST 800-53, and SOC 2 requirements.

Scope​

This policy applies to all RS Tech Services employees, contractors, and third parties who require access to company-managed systems, applications, or client environments. It governs the full lifecycle of user access, from onboarding and role assignment to modification and deactivation, and applies to all accounts used by employees, contractors, and third parties.

Systems covered under this policy include corporate network resources, cloud applications, internal administrative systems, and customer-facing service platforms maintained by RS Tech Services.

Compliance with this policy is mandatory for all workforce members. Exceptions require written approval from the Information Security Manager or designee.

Safeguards​

To ensure secure and compliant access management practices, RS Tech Services shall:

  • UA-01 Establish documented roles and responsibilities for account provisioning, maintenance, and termination.
  • UA-02 Grant system access based on the principle of least privilege and verified business need.
  • UA-03 Require unique user IDs for all accounts, ensuring individual accountability.
  • UA-04 Prohibit the use of shared or generic accounts except where explicitly approved and monitored.
  • UA-05 Use multifactor authentication (MFA) for all privileged accounts and remote connections.
  • UA-06 Define procedures for timely account creation, modification, and deactivation following personnel changes.
  • UA-07 Enforce password complexity and rotation in accordance with current industry standards (e.g., NIST SP 800-63B).
  • UA-08 Review user access rights at least quarterly to verify ongoing appropriateness.
  • UA-09 Require immediate revocation of access upon employee or contractor separation.
  • UA-10 Document all access management actions through a centralized ticketing or identity management system.
  • UA-11 Maintain and protect privileged access credentials using a secure password management solution.
  • UA-12 Monitor and log authentication activities, including failed login attempts and privilege escalations.
  • UA-13 Ensure that system administrators receive periodic training on secure access management and audit readiness.
  • UA-14 Perform periodic reviews of this policy and associated SOPs to ensure alignment with evolving standards and threats.

Policy Sanctions​

Non-compliance with this policy may result in disciplinary action consistent with RS Tech Services’ human resources and security procedures. Sanctions may include retraining, written warnings, suspension of system privileges, or termination of employment or contracts.

Violations involving intentional misuse, unauthorized access, or data compromise may also result in legal action in accordance with applicable cybersecurity and privacy laws.

Compliance / References​

  • RS Tech Services – Account Deactivation Standard Operating Procedure (SOP)
  • ISO/IEC 27001:2022 – A.5.17 Authentication Information, A.5.18 Access Rights
  • NIST SP 800-53 Rev. 5 – AC-1, AC-2, AC-3, AC-5 (Access Control Family)
  • SOC 2 Trust Services Criteria – Logical and Physical Access Controls (CC6.1–CC6.8)

Revision History​

VersionDateDescription of ChangeAuthor
1.009-01-2025Initial DraftR. Steele