Access control
In one sentence
The rules and process for who can get into which systems, and how access is granted and removed.
Access control covers how accounts are created, what each role can reach, and (critically) how access is revoked when someone leaves. Orphaned accounts from departed employees are a classic breach entry point.
Why it's on your cyber insurance application
Carriers ask how quickly access is removed at offboarding; a documented same-day process is the strong answer.
What this looks like in practice
Write down three things: how a new person gets accounts, who approves access to the sensitive systems, and what happens the day someone leaves. One page covers it. The reason underwriters ask is that account cleanup is the chore that slips first, and an orphaned login is a working door with nobody watching it.
How the Readiness Check scores it
The free Check asks the same question a carrier will. Here it is, why it's asked, and the fix if today's honest answer is no. The full application question list has the rest.
Access control & offboarding
When someone leaves the company, how quickly is their access removed?
Why carriers ask: Orphaned accounts from departed employees are a classic breach entry point. Carriers ask whether access removal is immediate and documented.
If the answer is no: List every system a departing employee touches; turn it into a checklist; assign an owner. Two hours, permanent fix.
The written evidence carriers accept
A “yes” on the application needs a document behind it. In the Readiness Pack, that document is:
Related terms
Would you pass this question today?
The free Readiness Check scores you across the ten control domains carriers probe, in five minutes, no email required for the score.