T-030-006 Access and Segregation-of-Duties Review Record
- Governed by
GP-030 Cyber Security Management
Purpose
Periodic review of production-system access assignments and segregation of duties (SoD). Each run of the review confirms that:
- Every active principal (user, role, service account) has access appropriate to its assigned role.
- No principal holds a combination of permissions that would breach segregation-of-duties constraints.
- No stale accounts remain active (no sign of use in the previous 90 days).
- Administrative access to production systems is gated behind multi-factor authentication.
Periodicity
Every 6 months (semi-annual). Additional reviews are performed on any change of role, on any onboarding or offboarding event, and on any material change to the access model.
Scope of the review
Production cloud infrastructure (AWS)
- IAM users, IAM roles, and service accounts across the production accounts.
- Multi-factor authentication status of every human principal.
- Attached IAM policies (managed and inline) verified for least-privilege.
Source-code repository (organisation-level)
- Organisation members and organisation-level admin rights.
- Write access to protected branches on production-releasable repositories.
- Third-party applications and OAuth integrations that hold write scope.
Review methodology
Current active principals are enumerated from each system in scope and cross-checked against the role assignments recorded in the QMS responsibilities matrix. For every principal:
- Permissions attached to the principal are confirmed minimal for the holder's current role.
- SoD-critical splits are verified, in particular the separation between "manage production infrastructure" and "approve production deployments", and between "clinical operation" roles and "reviewer or approver" roles.
- Last-login or last-use timestamp is checked; any principal with no activity in the previous 90 days is flagged for removal.
Review history
Each semi-annual review adds one row to the table below, signed by the reviewer and the approver.
| Review date | Reviewer | Approver | AWS SoD conflict | AWS stale accounts | Repo SoD conflict | Repo stale accounts | Corrective actions | Outcome |
|---|---|---|---|---|---|---|---|---|
The Outcome column states "Clean" when no SoD conflict, no stale account, and no over-privileged principal is found. When any of those conditions is not met, the outcome column records the reference of the corrective action opened under GP-006 Non-conformity. Corrective and Preventive actions, so that traceability is preserved.
Criteria for acceptance
A review is accepted when every column of the row is populated, the reviewer and the approver are distinct roles, and every finding category is either "None" or is cross-referenced to an open corrective action.
Record signature meaning
- Reviewer: JD-007 Reviewer name — enumerates principals, cross-checks against the responsibilities matrix, documents findings.
- Approver: JD-001 Approver name — confirms the review was performed and accepts the outcome.
- The reviewer and the approver are held as distinct roles. The reviewer is the principal administrator of the production systems in scope; the approver holds no day-to-day operational access to those systems. This split preserves segregation of duties for the review itself.
Template signature meaning
Delete this section when you create a new record from this template.
- Author: JD-007 Gerardo Fernández
- Review: JD-004 Saray Ugidos
- Approval: JD-001 Ms. Andy Aguilar