Passphrases, password managers, multi-factor authentication, least privilege and tightly controlled admin accounts – aligned with NCSC guidance and Cyber Essentials.
IT & cyber security
Password and Access Control Policy
About this document
A policy covering how people prove who they are (passwords, passphrases, passkeys and MFA) and what they can access (least privilege, joiners, movers and leavers, admin accounts, supplier access and access reviews). It follows the NCSC’s approach of making the secure option the easy one, and the Cyber Essentials user access control requirements.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
IT & cyber security
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
