Small business ,big audit

[Ormesherg]

Hello

We recently had an audit from one of our clients, some of the actions they wish us to implement regarding Access Control principles are as follows.

Customer are required to develop controls/procedures/policies in place to demonstrate:

1. that access is segregated to ensure conflicting roles are not provided to the same user

1. evidence that an individual cannot authorise their own access, evidence that user account administrators who create, modify or revoke a user account are not permitted to be involved in the authorisation process

1. evidence that approval of user access, set up user access, and monitoring of access violations/violation attempts are fully segregated

1. evidence that the individuals with privileged user access do not perform their own privileged user access monitoring

1. evidence that the individual responsible for setting up users, access, passwords or software changes must not have access to process their own access

1. evidence that the individual responsible for recording transactions must not have access to approve the transactions.

The above would not be a problem in a large organisation but we have 5 employees with access to the system. I am the global admin and administrate the environment as well as working normally.

The other people in the office are not that tech savvy so how would we address the above points?

Regards

Jim

[#2]

What they are asking for is overkill in my opinion. My recommendation would be to keep everything open/read only access for internal users. For specific content allow contribute/full control. This would reduce your administration. For private content your users can use there OneDrive accounts. Keep it off the Intranet. @Ormesherg