Access Control Policy (A.5.15)

Document ID: access-control-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Quarterly (access review) + Annual (policy review)

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

---

Purpose

Define the rules for granting, managing, and revoking access to SigmaShake systems and data.

Access provisioning

1. Staff portal gate — The compliance staff portal accepts a request only if two checks pass. First, the client IP must match the STAFF_IP_ALLOWLIST CIDR list. Second, the request must carry a valid session_id cookie from an accounts.sigmashake.com GitHub sign-in, and the session user ID must match the configured staff user ID allowlist (ALLOWED_GITHUB_USER_ID, ISMS owner role). This policy does not claim that sigmashake-sso authenticates all human access to production systems.
2. MFA monitored, not enforced by the portal — The staff portal gate does not check MFA. The sso-mfa-coverage collector reads sigmashake-sso accounts daily and opens a gap for any active account that has no WebAuthn factor.
3. Role-based access — Access is scoped by role (admin / staff). No shared accounts.
4. Least privilege — API tokens and service accounts are granted the minimum permissions required. GitHub App installation permissions are snapshotted weekly by oauth-scopes, which flags write, admin, delete and manage levels. The age of API tokens (Cloudflare, Stripe, Resend) is inventoried daily by secrets-store-age. Cloudflare membership is audited daily by cf-members.

Access review

Formal access review is conducted quarterly:

• All GitHub organisation members reviewed against active-employee list
• All Cloudflare account members reviewed
• All SigmaShake SSO accounts and roles reviewed
• API tokens (Cloudflare, Stripe, Resend) are inventoried daily by secrets-store-age (age only; see the access review procedure)
• Results recorded as evidence by access-review collector

Access revocation

Upon role change or offboarding: all access revoked within 24 hours. Automated detection: github-members and cf-members collectors open a gap if an unknown member appears.

Privileged access

• The staff portal sets no session lifetime of its own. It reuses the shared accounts.sigmashake.com session, and accounts sets the session lifetime.
• Break-glass IP allowlist override (IP_ALLOWLIST_BREAK_GLASS) is logged and sends a Discord alert when the Discord webhook is configured.

Remote access

Remote working is the default operating model. See Remote Working Procedure (A.6.7) for device requirements.

Evidence

Collector	Cadence	Control
sso-mfa-coverage	Daily	A.5.15, A.5.17, A.8.2, A.8.5
github-members	Daily	A.5.15, A.5.18, A.6.5
cf-members	Daily	A.5.15, A.5.18
oauth-scopes	Weekly	A.5.18, A.8.4
access-review	Quarterly	A.5.18, A.8.2