Higher-risk access.
WHAT COUNTS
Banking Payment gateway Accounting records Customer data Staff records
WHAT TO APPLY
Individual accounts Two-factor authentication The minimum permissions necessary Separation of duties, where practical
SEPARATION OF DUTIES
The person who raises a payment is not the person who approves it.
For a small business, that may not be possible for everything.
Apply it where the amounts justify it.
WHAT TO LIMIT
Who can export customer data Who can change payment details Who can authorise payments, and up to what
WHAT TO MONITOR
Access to these systems Exports of customer data Changes to payment details
FOR CUSTOMER DATA
Access carries obligations.
Visit zillionkinghost.com for further information.
WHAT TO REVIEW
Who has access to each, quarterly.
WHAT TO DOCUMENT
The limits, in writing, so they are consistent.
