1. Purpose and Scope
The purpose of this Access Control Policy is to define the requirements for granting, managing, reviewing, and revoking logical access to Northwind Health (sample) information systems, applications, and data. Northwind Health (sample) processes protected health information (PHI) and customer personally identifiable information (PII), and therefore must maintain rigorous controls over who can access what, when, and under what circumstances. This policy establishes the minimum baseline for logical and physical access controls across the organization and is designed to satisfy the AICPA 2017 Trust Services Criteria, specifically CC6.1, CC6.2, and CC6.3, which address logical access security, user access provisioning, and access removal respectively.
This policy applies to all employees (24 full-time and contract personnel), contractors, vendors, and any other individual or entity granted access to Northwind Health (sample) systems, including but not limited to Google Workspace, Amazon Web Services (AWS), GitHub, GitHub Actions, Slack, Datadog, Kandji, and Gusto. It covers access to production environments, development environments, corporate systems, and any system that stores, processes, or transmits PHI, customer PII, or other confidential information. All access must be granted based on business need, authorized by the appropriate manager, and logged for audit purposes (CC6.1).
The scope of this policy is aligned with the SOC 2 examination period of October 16, 2025 through October 15, 2026, during which Northwind Health (sample) is subject to a Type II examination. Controls described herein must be operating effectively throughout this period. Any exceptions to this policy must be documented, approved by the Security Officer, and reviewed at least quarterly (CC6.2).
2. Access Control Principles
Northwind Health (sample) adheres to the principle of least privilege, meaning that every user, system account, and service account is granted only the minimum level of access necessary to perform their assigned job duties. Access rights must be scoped narrowly and time-bound where possible. No individual shall retain standing access to systems or data that is no longer required for their current role. This principle is a foundational control supporting CC6.1, which requires that access to information assets be restricted to authorized users, processes, and devices.
Need-to-know is an equally binding principle at Northwind Health (sample). Even within systems to which a user has technical access, personnel must limit their actual access, viewing, and use of PHI, customer PII, and other sensitive information to the specific data required for an authorized business task. For example, a Support Engineer may have access to the support ticketing system but must not view patient records outside of an active, documented support engagement. The Security Officer is responsible for annually reaffirming with all department heads the scope of access required for each role, with reference to CC6.1 and CC6.2.
All access rights must be based on role and job function (RBAC), as further defined in Section 5. Where a user requires temporary elevated access, the Security Officer must approve a time-bound exception, which automatically expires after no more than 30 days unless re-approved. The principle of least privilege is reinforced at Northwind Health (sample) through automated provisioning in Google Workspace, AWS IAM, and GitHub, which removes access automatically upon termination or role change, as described in Sections 3 and 10.