Access Control Policy

Purpose and scope

Pistachio AS and its subsidiaries (Pistachio) limit access to information, systems and facilities to people with a business need. This policy covers every system that holds the data we process for our customers or other confidential information, and everyone who uses them, including contractors and partners.

Our principles

• Least privilege. People get only the access their role needs. Anything not granted is denied by default.
• Role-based access. Access is assigned by role and group wherever possible, so it stays consistent.
• One person, one account. Accounts and credentials are never shared, and user IDs are never reused.
• Segregation of duties. No single person can both start and approve a sensitive action.

Granting and removing access

• Access is granted and removed through documented onboarding and offboarding procedures, each checked by a second person.
• No one gets access before their start date.
• Extra access needs approval from the system owner or a manager, and every change is recorded.
• We review access rights every quarter, and when someone changes role.
• People lose their access when they leave, and access that is no longer needed is removed too.

Privileged access

• Multi-factor authentication is required for all privileged access to production.
• Privileged access is granted only for as long as a task needs it, using separate admin accounts where feasible.
• Generic admin accounts are not used, and every privileged login is logged.
• Tools that can override system controls are restricted to the fewest people possible.

Strong authentication

• Everyone uses strong, unique passwords stored in an approved password manager.
• Passwords are always stored and sent encrypted or hashed.

Source code

Access to our source code is limited to authorised developers, based on business need, and logged.

Version history