Access standard
Every access path has an owner and an exit.
Access follows the work, not a title. A request must identify the person, system, client boundary, purpose, least privilege required, approver, start, review date, and removal condition.
ForPeople conducting policy, privacy, security, or access review
FocusControls, ownership, evidence, and review paths
Access lifecycle
Request: tie access to an approved role and work boundary.
Approve: confirm identity, purpose, data class, environment, duration, and reviewer.
Provision: use individual credentials, least privilege, MFA where supported, and auditable group membership.
Review: revalidate need, privilege, conflicts, inactivity, and expiry.
Change: reopen approval when role, scope, system, data, or location changes.
Remove: revoke access at transfer, role change, inactivity threshold, incident, or engagement close.
Verify: retain removal and exception evidence with the handoff record.
Shared credentials, unrecorded privilege, indefinite access, and unmanaged production entry are outside the standard.