# SAMPLE: Access Control Policy

> This is a sample document published by ISMS Copilot (ismscopilot.com/mcp) for trying the example prompts. Example Co is fictional. It is written with gaps on purpose: do not use it as your policy.

**Company:** Example Co (fictional), a 25-person SaaS company
**Owner:** Head of Engineering
**Version:** 0.3, draft

## 1. Purpose

This policy sets out how Example Co gives and removes access to its systems and data.

## 2. Scope

All employees and contractors, and the production systems on AWS, Google Workspace, GitHub and the customer support tool.

## 3. Granting access

1. A manager requests access for a new joiner in the #it-requests Slack channel.
2. The Head of Engineering creates the accounts.
3. New joiners get the same access as others in their team.

## 4. Passwords

Passwords must be at least 8 characters. Staff should not share passwords.

## 5. Administrator access

Engineers who need it have AWS administrator access. The founders have Google Workspace super admin rights.

## 6. Leavers

When someone leaves, their manager tells the Head of Engineering, who removes their accounts.

## 7. Customer data

Support staff can view customer accounts in the support tool when a customer asks for help.