Access Control Policy

Purpose

This policy defines the requirements for controlling access to Carriyo's information systems, applications, and data. It ensures that access is granted based on the principle of least privilege and is regularly reviewed.

Scope

This policy applies to all access to Carriyo systems, including production infrastructure, development environments, administrative tools, and third-party services.

Principles

Least Privilege

• Users are granted the minimum level of access required to perform their job functions
• Elevated access is granted only when necessary and is time-limited where possible

Separation of Duties

• Critical functions are divided among different individuals to prevent fraud and error
• No single person has unrestricted access to all systems

Need-to-Know

• Access to confidential and restricted information is limited to individuals who require it for their role

Authentication Requirements

Password Policy

• Minimum 12 characters with complexity requirements
• Passwords must not be reused across services
• Authentication is SSO-first: Google Workspace SSO wherever available, with application authentication managed through AWS Cognito; no standalone password manager is deployed or required. Passwords for non-SSO accounts must be unique per service

Multi-Factor Authentication

• MFA is mandatory for all production system access
• MFA is mandatory for all administrative access
• Remote access to Carriyo systems is through Google Workspace SSO; MFA is required for remote access (MFA enforcement on the SSO to be verified before it is cited as evidence). A VPN as an additional layer for critical systems (AWS infrastructure and future servers) is planned
• Hardware security keys are supported and recommended

Single Sign-On

• SSO is used for centralized identity management where supported
• SSO integration reduces password fatigue and improves security posture

Access Management

Provisioning

• Access requests follow a formal approval process
• Access is provisioned based on role-based access control (RBAC)
• New employees receive access based on their job function and team

Review

• Access reviews are conducted at least twice a year for all systems
• Privileged access is reviewed monthly
• Managers are responsible for confirming the access levels of their team members

Deprovisioning

• Access is revoked immediately upon termination of employment or contract
• Temporary access is automatically expired after the agreed period
• Offboarding checklists ensure complete access removal

Privileged Access

• Administrative and root access is strictly controlled
• Privileged access sessions are logged and monitored
• Just-in-time (JIT) access is used where possible to minimize standing privileges
• Privileged access requires separate credentials from standard user accounts

Remote Access

• Remote access to Carriyo systems is over encrypted connections (HTTPS/TLS 1.2 or higher) with authentication through Google Workspace SSO and MFA where enforced. Carriyo operates no corporate VPN today; the control in place is Google Workspace single sign-on (SSO) in front of most systems. A VPN is planned as an additional layer for access to critical systems (the AWS infrastructure and any future servers); once in place, access to the systems behind it shall require it. MFA enforcement on the SSO is to be verified before it is asserted
• All remote sessions require MFA
• Remote access is logged and monitored
• Access from untrusted networks may be restricted for sensitive operations

Audit and Monitoring

• All authentication events are logged
• Failed authentication attempts trigger alerts after a defined threshold
• Access logs are retained for a minimum of 12 months
• Regular audits verify that access controls are functioning as intended

Change Log