Access Reviews Policy
Document control
| Field | Value |
|---|---|
| Owner | Ron Benisty — CTO & CSO (ron.b@iontwrks.com) |
| Status | Approved |
| Version | 1.0 |
| Classification | Confidential |
| Approved by | Ron Benisty — CTO & CSO |
| Approval date | 2026-05-26 (Tuesday) |
| Last reviewed | 2026-05-26 |
| Review cycle | Annual — next review due May 2027 |
| Parent policy | Secure SDLC (SSDLC) |
Satisfies ISO/IEC 27001:2022 A.5.18 (access rights — provisioning, review, removal) and SOC 2 Type II CC6.1–CC6.3 (logical-access provisioning, modification, removal). Closes the access-review portion of the SSDLC gap analysis (referenced under §4 of the SSDLC umbrella).
1. Purpose
Confirm — on a documented cadence — that every identity with access to S.E.T's systems still needs it at the privilege level it has, and remove access promptly where it is no longer warranted.
2. Scope
| System | Identities reviewed | Reviewer |
|---|---|---|
| GitHub (org + repos) | All collaborators (S.E.T team + third-party dev firm members), bot/service accounts, deploy keys, Personal Access Tokens, GitHub Apps | CTO & CSO |
| AWS IAM (management, shared-services, set-nonprod, set-prod-eu, future set-prod-il) | IAM users, IAM roles, OIDC trust relationships, access keys, MFA status | CTO & CSO |
| WorkOS | Admin users + each customer Organization's owner | CTO & CSO |
| Logz.io | Account members, alert channels, API keys | CTO & CSO |
| Cloudflare | Org members, API tokens | CTO & CSO |
| Sub-processors with admin consoles | One named owner per processor | CTO & CSO |
3. Cadence
| Frequency | Activity | Source / cross-reference |
|---|---|---|
| Monthly | GitHub audit-log review — review the rolling 30-day audit log for unusual access patterns | Supply Chain §3 |
| Quarterly | Full collaborator / identity reconciliation per system — for every identity, confirm: (a) still employed / contracted, (b) still needs access, (c) at the right privilege level | This policy |
| Quarterly | IAM Access Analyzer review — investigate every flagged overly-permissive policy | Environments §IAM |
| Annually | Right-to-audit exercise against the third-party dev firm — confirm their developer roster matches our GitHub collaborator list | Supply Chain §3 + Audit Testing Scope §3 |
4. Off-boarding SLA
- Departing S.E.T-team member: all access revoked within 24 hours of departure decision — GitHub, AWS IAM, WorkOS, Logz.io, Cloudflare, hardware tokens collected, sub-processor admin consoles.
- Departing contractor developer: dev firm notifies within the agreed contract window; S.E.T removes GitHub access within 24–48 hours (Supply Chain §3 contract clauses).
- Compromised credential: revoked immediately as part of Incident Response.
5. Privilege model
- Least privilege at all times — every identity holds the minimum role required.
- Separation of duties preserved per the Separation of Duties Policy.
- No long-lived AWS access keys where avoidable — prefer
assume-rolewith MFA and temporary credentials (Environments §IAM). - MFA mandatory on every identity that supports it (GitHub, AWS IAM, WorkOS).
- Service accounts / bots are documented — purpose, owner, secret rotation cadence.
6. Evidence
Each cycle produces:
- A signed review record (the reviewer's checklist).
- A diff of identities added / removed / modified vs. the previous cycle.
- A short note for any identity intentionally kept at elevated privilege.
Retained ≥ 12 months per the Evidence Collection & Retention Policy. SOC 2 Type II will sample these records.
7. Document change history
| Version | Date | Author | Description of change | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-05-26 | Ron Benisty (CTO & CSO) | Initial version — establishes the access-review cadence and scope. | Ron Benisty (CTO & CSO) |