User Access Management Policy

Purpose

This policy establishes Westlink Logistics’ requirements for managing user access to information systems, applications, and data. It ensures access is granted, modified, and revoked on a need-to-know and least privilege basis in accordance with the ISM, DISP, and ISO 27001:2022.

Scope

This policy applies to all Westlink Logistics information systems, cloud services, applications, and data repositories. It covers all users including directors, workers, contractors, and third parties with access to Westlink systems. It supplements TEC-POL-001 (Information Security Policy) with specific access management requirements.

Organisational Context

Westlink Logistics is a fully cloud-based Microsoft 365 organisation. Identity and access management is centred on Microsoft Entra ID (formerly Azure AD). The organisation holds DISP membership and handles information up to OFFICIAL:Sensitive, requiring access controls aligned with ISM requirements and Essential Eight Maturity Level 2 (restrict administrative privileges, application control).

The workforce includes office-based, field, and remote workers across multiple states, with contractors and third parties requiring varying levels of system access. JOSCAR pre-qualification requires demonstrated access management controls.

Policy Commitments

Westlink Logistics is committed to:

• Managing the full account lifecycle: user accounts are created only on authorised request with manager approval, modified when roles change, suspended immediately on notification of leave or investigation, and revoked within one business day of termination or cessation of engagement.

• Requiring multi-factor authentication (MFA) for all users on all cloud services, remote access, and systems processing OFFICIAL or OFFICIAL:Sensitive information. Passwords must meet minimum complexity and length requirements per ISM guidelines. Shared or generic accounts are prohibited.

• Applying role-based access control with least privilege. Privileged and administrative access is restricted to named individuals, subject to enhanced logging, and reviewed quarterly. Separation of duties is applied to prevent any single user from controlling critical functions end-to-end.

• Conducting formal access reviews at least every 12 months for all users, quarterly for privileged accounts, and immediately on role change, transfer, or termination. Access rights that are no longer required must be revoked promptly.

• Maintaining access logs for all system authentication and authorisation events. Logs must be retained for the period specified by ISM and must be available for security incident investigation and compliance audit.

Responsibilities

Review

This policy is reviewed annually as part of the management review cycle, or when significant changes occur to the identity platform, ISM requirements, or following an access-related security incident. This policy is communicated to all users and is available to Defence and JOSCAR assessors on request.

Applicable Standards and Legislation

• Australian Government Information Security Manual (ISM) — ACSC

• Protective Security Policy Framework (PSPF)

• Defence Industry Security Program (DISP) — Security Governance Framework

• ISO/IEC 27001:2022 Information Security Management Systems — Requirements

• ISO 9001:2015 Quality Management Systems — Requirements

Related Documents

• TEC-POL-001 Information Security Policy

• GOV-POL-015 Privacy Policy

• DEF-POL-001 Security Policies and Plans