CZ_TEST3_END-2-END

Restrictive Data Access Policy (Least Privilege Model) Policy Status: Active | Effective Date: 2025-10-21 Purpose: To protect organizational data by ensuring that all users, processes, and applications are only granted the minimum permissions necessary to perform their required duties. This policy enforces a Zero Trust security architecture. 1. Scope and Application This policy applies to all internal employees, contractors, third-party vendors, and any system or application that interacts with Confidential or Restricted data assets, regardless of data location (on-premise or cloud). 2. Access Principle: Least Privilege Access must be granted only on a need-to-know basis. 2.1 Role-Based Access Control (RBAC) All data access must be defined, enforced, and managed through strict, pre-approved Role-Based Access Control (RBAC) profiles. Roles must be reviewed and re-approved by data owners quarterly. Users must not hold more than two roles that grant access to Restricted data concurrently. 2.2 Explicit Permissioning Access is denied by default. Any request for access requires: Written justification from the user detailing the specific business need. Written approval from the relevant Data Owner and the Security Office. Automatic access expiration (time-bound access) after 90 days, requiring re-submission and re-approval. 3. Security Requirements 3.1 Authentication and Identity Multi-Factor Authentication (MFA) is mandatory for all access to data sources. Access must utilize Non-Repudiable Unique Identifiers. Shared accounts are strictly prohibited. 3.2 Data Movement and Export No bulk data export is permitted from Restricted systems without express, documented approval from the Chief Information Security Officer (CISO). Copying data to personal devices, removable media, or unsanctioned cloud storage is strictly forbidden. 4. Monitoring and Compliance All data access attempts, failures, and actions (read, write, delete) must be logged and retained for a minimum of five years. The Security Operations Center (SOC) will conduct automated, real-time monitoring for anomalous access patterns. Immediate disciplinary action, up to and including termination, will be taken for policy violations. 5. De-provisioning Access will be revoked immediately upon a change in role, project completion, or separation from the organization. Automated systems must enforce de-provisioning within one hour of notification.