Access Control Policy

1. Purpose and scope

This policy governs the granting, management, and revocation of access to UniMatter information systems, applications, and data. It is designed to ensure that access is limited to those who require it, that access is authenticated to an appropriate standard, and that access is removed promptly when it is no longer required.

This policy applies to all systems operated by or on behalf of UniMatter, to all categories of user including the principal, contractors, and subprocessors, and to both administrative and standard access.

2. Least privilege and need to know

Access is granted on the principle of least privilege: each user is given the minimum level of access necessary to perform their assigned function, and no more. Access to personal and confidential client information is further restricted by a need-to-know assessment tied to the specific engagement.

Privileged and administrative access is restricted to the smallest practicable number of users, is granted only where operationally necessary, and is separated from routine access where practicable.

3. Authentication

Access to UniMatter systems requires authentication to a standard commensurate with the sensitivity of the information. The firm aligns its authentication controls with the Australian Cyber Security Centre Essential Eight, including the use of multi-factor authentication.

1. Multi-factor authentication is required for all access to systems holding personal or confidential client information, and for all administrative access.
2. Credentials are unique to each user; shared or generic accounts are not used except where technically unavoidable and individually authorised.
3. Passphrases meet defined length and complexity requirements and are stored only in an approved credential manager.
4. Authentication factors that are compromised or suspected of compromise are reset without delay.

4. Access provisioning and change

Access is provisioned only on an authorised request that identifies the user, the systems and data required, and the business justification. Changes to a user’s access follow the same authorisation path and are recorded.

Access for contractors and subprocessors is time-bound to the engagement and is provisioned against the obligations set out in the Third-Party and Vendor Risk Policy.

5. Access reviews

UniMatter periodically reviews access entitlements to confirm that they remain appropriate and that least privilege is maintained. Privileged access is reviewed more frequently than standard access.

A review that identifies access that is excessive, dormant, or no longer justified results in prompt adjustment or removal of that access, and the action is recorded.

6. Revocation of access

Access is revoked promptly when an engagement concludes, when a role changes such that the access is no longer required, or when access has been compromised. Revocation includes the disabling of accounts, the invalidation of active sessions and tokens, and the return or destruction of any access devices.

Where a security incident warrants it, access is revoked immediately and on a precautionary basis, in coordination with the Incident Response Policy.

7. Remote and third-party access

Remote access to UniMatter systems is conducted over encrypted channels from devices that meet the firm’s security requirements. Access from unmanaged or untrusted networks is subject to additional controls.

Third-party access is granted only under an agreement that imposes equivalent security and confidentiality obligations, is restricted to the systems and data necessary, and is monitored and logged.

8. Logging and accountability

Access to systems holding personal or confidential information is logged to a standard sufficient to support investigation and audit. Logs are protected against alteration and are retained in accordance with the Data Retention and Deletion Policy.

Each user is accountable for activity conducted under their credentials. The sharing of credentials is prohibited.

9. Review

This policy is reviewed at least annually and on any material change to the firm’s systems or risk profile. Enquiries may be directed to UniMatter at administrator@unimatter.com.au.