All Categories > Enterprise Security Assessment > Data and Asset Security > Access Control

Access Control

Information about physical and informational access of third-parties, subcontractors and customers, as well as password policies and constituent's access rights.

QR Planet's Access Control Policy

Find a comprehensive description of QR Planet's Access Control Policy, handling all access-related issues for employees, contractors, partners and customers.

Last update 4 days ago

Do you allow Constituents to access Scoped Data?

Yes. But only during client setup and support, and restricted to defined roles. The approval of access rights is segregated from the implementation.

Last update 1 week ago

Do you employ segregation of duties for granting and approving access to Scoped Systems and Data?

Yes. When necessary, granting and approving access requests to Scoped Systems and Data is segregated in order to minimize risks.

Last update 1 week ago

Do you employ segregation of duties for approving and implementing access requests for Scoped Systems and Data?

Yes. When necessary, approving and implementing access requests to Scoped Systems and Data is segregated in order to minimize risks.

Last update 1 week ago

Do you limit access to your systems that store or process Scoped Data?

Yes. Both physical and remote access to all of QR Planet's systems, whether storing or processing scoped or other data, is restricted on a need-to-access-basis.

Last update 1 week ago

Do you have an Access Control Policy in place?

QR Planet's Access Control Policy has been developed in accordance with all relevent compliance requirements and current standards and is subject to reviews.

Last update 2 weeks ago

Do you allow your clients to manage access to their own systems and data?

Yes. QR Planet's clients have the option to add users (additional QR Codes and access credentials) and sub-accounts (only access), as per contractual agreement.

Last update 2 weeks ago

Do you have a set of rules governing the way user IDs are created, assigned, and used?

All our IDs are created and assigned in accordance with all applicable internal policies and the commonly accepted rules and best practices.

Last update 2 weeks ago

Do you provision your access controls according to the principle of least privilege?

all access controls to applications, operating systems, databases, and network devices, remote or on-site, are provisioned to the principle of least privilege.

Last update 2 weeks ago

Does your system policy require securing active sessions and logoff when the session is finished?

Yes. Any active session and connection to terminals, PCs or servers within QR Planet's environment needs to be secured and completely terminated.

Last update 1 week ago

Do you have a process in place for the appropriate handling of user access rights?

Yes. Access rights are reviewed periodically and also when a Constituent's role changes, and are adjusted if necessary, especially privileged access rights.

Last update 1 week ago

Do you disable inactive Constituent user IDs and delete them regularly?

Yes. Inactive user IDs and accounts of employees, consultants or other Constituents are disabled and also deleted after defined periods of inactivity.

Last update 3 weeks ago