System Access Control & Remote Access Policy
eXpress badging® enforces management-approved access controls for all systems that transmit, process, or store Scoped Systems and Data.
🔐 Controls include unique user IDs, session timeouts, least-privilege provisioning, strong authentication, supervised remote access, and encryption for all data transfers. This policy is reviewed regularly and aligned with NIST CSF 2.0.
🧾 Cheat-Sheet (Answers)
-
Are electronic systems used? Yes — AWS-hosted Portal and internal systems.
-
Access control policy approved & owned? Yes — leadership-approved; Technical Ops owner; communicated org-wide.
-
Unique user IDs? Yes — no shared accounts.
-
Inactive session timeout ≤ 15 min? Supported; configurable by Customer User Admin.
-
Access grant/approval process? Yes — ticketed joiner/mover/leaver with approvals.
-
Passwords required? Yes — required for all users; MFA for remote/support/admin access.
-
Remote access permitted? Yes — company devices only, approved tools, supervised, segmented, encrypted.
-
Remote access: company-owned equipment only? Yes — exclusively.
-
Prevent copying to remote devices? Yes — file transfers require explicit approval and follow ticketed authorization; sessions are supervised and may restrict clipboard/file transfer as policy.
🧭 Scope & Definitions
-
Scoped Systems and Data: Veonics® Portal production services (AWS), customer badge data & photos, and internal systems used to support those services.
-
Constituents: Employees, contractors, and approved partners/customers with system access.
🧑⚖️ Governance & Ownership
-
Approved by: Executive Leadership
-
Policy Owner: Technical Operations Lead
-
Review Cadence: At least annually, and quarterly for operational control checks (firewall/ACL, access reviews, session settings).
-
Communication: Onboarding training + internal updates; enforced through EOS accountability.
Related:
-
📶 WiFi Governance (see Wireless section below)
👤 Unique User IDs & Authentication
-
Unique accounts are required for all access to systems handling Scoped Data (no shared logins).
-
Passwords required for all users; privileged roles require strong authentication (MFA enforced for remote/support tools and admin access).
-
Accountability: All activity is attributable to an individual user via logs.
Related:
⏱️ Session Management
-
Inactivity timeouts are supported; in the Veonics® Portal, session timeouts are configurable by the Customer User Admin.
-
Standard: 15-minute timeout for privileged roles (customer admins may set stricter values per compliance needs).
🔄 Access Provisioning (Joiner/Mover/Leaver)
-
Grant: Role-based, least-privilege access upon manager request and approval (ticketed).
-
Change of Status: Permissions reduced/adjusted immediately on role changes.
-
Termination: Accounts disabled within minutes of HR confirmation; credentials revoked; keys/devices recovered.
-
Audit Logs: Access changes and user actions are logged for review.
Related:
-
👥 Security Roles & Responsibilities (internal)
🌐 Remote Access (When, How, and By Whom)
-
Permitted only when necessary, via company-owned, managed devices and approved tools.
-
AWS / Cloud Admin Access: Restricted to authorized personnel with secure credentials; network isolation via VPCs and security groups.
-
Third-Party Remote Support: Performed rarely using GoTo Assist for printer support; sessions are virtually escorted/supervised.
-
File Transfer Controls: File transfers during support require explicit approval and are restricted to approved, ticketed needs.
-
MFA: Required for remote support/admin accounts.
Related:
-
🤝 Remote Support Process: How do we enable remote technical support or training sessions
📶 Wireless Networking
-
In Use with approved SSIDs, segmented access, and strong encryption (WPA2/WPA3).
-
Governed by a documented WiFi policy; guest networks are isolated from production resources.
📨 Data Transfer & Encryption
-
Electronic only: No physical media for Scoped Data.
-
Approved channels:
-
🔒 Secure Upload Center (Citrix ShareFile) – How to securely transfer ID badge project files
-
🧭 Direct entry into Veonics® Portal – How is data entered into the Veonics Portal
-
-
Email with PII: Automatically rejected and deleted; customers are instructed to resubmit via approved secure channels.
-
Encryption: All transfers and storage use encryption in transit and at rest.
-
🔎 Overview: Security at a Glance
-
🛡️ Network Boundaries: Firewalls & Reviews
-
On-prem: SonicWall firewall protects internal perimeter; no “allow-any” rules.
-
Cloud (AWS): Security Groups and (where applicable) AWS Network Firewall enforce least-privilege ingress/egress.
-
Rule/ACL Reviews: Conducted quarterly and during change events; findings fed into remediation.
-
Vulnerability Testing: Internal/external VAPT via Fortra VM; remediation tracked.
Related:
🛰️ Oversight: DNS Filtering & Managed SOC
-
🌐 DNS Filtering: Blocks access to malicious/phishing/C2 domains at the network layer—preventing connections before payloads execute.
-
🛰️ Managed Security Operations Center (SOC): 24/7 monitoring and escalation across AV/EDR, DNS filtering, firewalls, remote access, and backups; proactive tuning and incident support.
Related:
🧭 NIST CSF 2.0 Alignment (at a glance)
| Function | Controls in this Policy |
|---|---|
| Govern (GV) | Management approval, policy owner, scheduled reviews |
| Identify (ID) | Role definitions, asset/scope identification |
| Protect (PR) | Unique IDs, passwords/MFA, least-privilege, firewalls, WiFi governance, encryption, DNS filtering |
| Detect (DE) | SOC monitoring, AV/EDR alerts, VAPT findings |
| Respond (RS) | Ticketed remediation, session controls, supervised remote access |
| Recover (RC) | Backups/restore processes and change rollbacks (see Backup & Recovery KB) |
Last Updated: (set date)