Access control and information security controls

1. Security principles

Zeenna access management is based on need-to-know, least privilege and separation of duties. Access is granted only to the extent required for a defined role or approved purpose.

• Users receive access only to systems and information required for their responsibilities.
• Users receive the minimum privilege required to perform their work.
• Critical activities and approvals are separated between individuals where feasible.
• Access outside standard roles requires documented business justification and approval.

2. Role-based and approved access

Zeenna combines role-based access control with formally approved access for cases not covered by a standard role. Critical systems and the roles permitted to access them are identified and maintained.

• Standard access is assigned according to the user’s role or team.
• Additional access is limited to a specific business or technical purpose.
• The ability to grant access is restricted to administrators of the relevant systems.
• External-user access requires approval and is disabled when no longer required.

3. Privileged access, MFA and SSO

Privileged access is governed by least privilege and included in periodic access reviews. Zeenna uses SSO and MFA where supported by the relevant system and where feasible.

For critical systems integrated with compliance monitoring, MFA status is monitored on an ongoing basis. Other critical systems require secure login and password-management controls, with evidence maintained.

4. Access reviews and user lifecycle

Access rights for production and non-production systems are reviewed at least annually, including privileged rights and separation-of-duties considerations.

• Discrepancies are documented and remediated.
• A role change triggers review and adjustment of access rights.
• On termination, access to critical systems is to be revoked within three days of the employee’s last working day.

5. Production environment and changes

Production is separated from other environments to reduce unauthorised access and unintended changes. Changes to production infrastructure, network configurations and critical software are governed by change-management processes.

• Changes are to be recorded, tested and approved before implementation.
• Requestor, reviewer or approver, and implementer responsibilities are separated where feasible.
• Production changes are recorded in centralised version-control or ticketing systems.

6. Logging, monitoring and detection

Logging is enabled on production infrastructure to support accountability and incident investigation. Relevant events may include privileged-account use, failed or unauthorised access attempts, system failures, policy violations and network events.

Logs are to be protected against tampering and unauthorised access, and retained in line with applicable legal, regulatory and contractual requirements.

7. Encryption and data in transit

Zeenna protects critical data through encryption at rest and in transit. Public Internet communications use a minimum standard of TLS 1.2 under the internal encryption policy and trusted certificates are used. Passwords and cryptographic keys must be stored securely.

8. Cloud security and data segregation

Critical cloud providers are required to support logical data segregation in multi-tenant environments, access control, authentication, log collection, encryption, incident management and disaster recovery. Their security posture is reviewed periodically.

AI and cloud API integrations use secure API-key and secret management, with minimisation of data shared with external services.

9. Network and endpoint security

Internet-facing systems and critical network infrastructure use appropriate network controls, which may include firewalls, limited connectivity, encryption and intrusion detection or prevention. Internet-deployed systems are required to undergo vulnerability checks.

Endpoints with access to critical systems or data must apply baseline controls such as software updates, anti-malware, disk encryption, strong credentials and automatic screen lock.

10. Vendor and third-party access

Critical vendors and third parties are assessed for security risk before engagement and reassessed at least annually. Vendor access is limited to an authorised need and removed when that need ends.

11. Responsibilities and governance

The Information Security Officer operates, monitors, reviews and improves the ISMS, coordinates controls and audits, and oversees annual reviews. Administrators and Infra Operations implement access and operational controls. Process owners apply security requirements in their areas. All users protect authentication information and report suspected weaknesses or incidents.

12. Related internal documentation

• Access Control Policy and Procedure
• Information Security Policy
• ISMS Information Security Roles and Responsibilities
• Operations Security Policy and Procedure
• Encryption Policy
• Communications and Network Security Policy
• Endpoint Security Policy
• Cloud Security Policy
• Vendor Management Policy and Procedure