Access Control Policy (Identity and Access Management – IAM)
PART I - PURPOSE, SCOPE, AND LEGAL BASIS
Article 1. Purpose
1.1. This Policy sets out the principles and measures for identity management and access control across all HiTechCloud systems, services, and data, ensuring that only properly authenticated and authorized subjects can access resources appropriate to their role and job needs.
Article 2. Scope of application
2.1. Applies to: HiTechCloud personnel (full-time, probationary, interns, contractors); service accounts and system accounts; Customer accounts and sub-accounts on the management portal; and access to infrastructure, applications, databases, source code, cloud systems, and internal tools.
Article 3. Legal basis and standards
- Law on Cybersecurity 2025 (Law No. 116/2025/QH15) and its implementing decrees; Decree 85/2016/ND-CP on securing information systems by classification level;
- The Law on Personal Data Protection 2025 (Luật Bảo vệ dữ liệu cá nhân 2025, Law No. 91/2025/QH15) and Decree 356/2025/ND-CP (Nghị định 356/2025/NĐ-CP) (which require strong authentication — multi-factor at minimum — and access authorization for the processing of large-scale or sensitive data);
- Penal Code 2015 (amended and supplemented 2017);
- Reference standards: ISO/IEC 27001:2022 (A.5.15–A.5.18, A.8.2–A.8.5); NIST SP 800-63 (Digital Identity); Zero Trust principles (NIST SP 800-207).
This policy supplements and gives effect to the access control requirements set out in the Information Security Management System (ISMS) Policy.
PART II – ACCESS CONTROL PRINCIPLES
Article 4. Core principles
4.1. HiTechCloud applies: (a) Least Privilege — grant the minimum permissions needed to do the job; (b) Need-to-know — access only the data needed for the task; (c) Separation of Duties — separation of duties to prevent conflicts of interest and abuse of authority; (d) Zero Trust — never trust by default; verify continuously by identity, device and context; (e) Deny by default — deny by default; allow only where access has been granted explicitly.
Article 5. Authorization model
5.1. HiTechCloud applies an RBAC (Role-Based Access Control) model, combined with ABAC (Attribute-Based) for sensitive cases. Access rights are assigned by role rather than by individual; each role carries the minimum set of permissions required for its job function.
5.2. Access to data is tiered according to the data classification in the ISMS (PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED); RESTRICTED data (sensitive personal data, payment data, secret keys) is granted only to roles that have been separately approved.
PART III – AUTHENTICATION AND IDENTITY MANAGEMENT
Article 6. Multi-factor authentication (MFA)
6.1. MFA required for: administrative accounts (admin/root); remote access (VPN, SSH, RDP); access to systems that process RESTRICTED data; cloud management consoles and CI/CD tooling.
6.2. Phishing-resistant authentication factors are preferred: FIDO2/WebAuthn and hardware security keys; SMS OTP is progressively phased out for privileged accounts. For large-scale or sensitive data processing, strong authentication of at least multi-factor is applied in accordance with Decree 356/2025/NĐ-CP (Nghị định 356/2025/NĐ-CP).
Article 7. Password policy
7.1. Minimum requirements: at least 12 characters for user accounts and at least 16 for privileged accounts; passphrases are encouraged; passwords are checked against breached password lists and common passwords are blocked.
7.2. Passwords are stored as hashes (bcrypt/Argon2/scrypt) with a random salt. Periodic password changes are not imposed as a formality; a change is only forced when there are signs of exposure or leakage (in line with the NIST SP 800-63B recommendation).
7.3. Password sharing is prohibited; system secrets (API keys, tokens, certificates) are managed through a secret manager and are not stored in source code or documentation.
Article 8. Privileged access management (PAM)
8.1. Privileged accounts are managed through a PAM system: (a) access is via a bastion host / jump server, never a direct connection; (b) permissions are granted Just-in-Time and on a Just-Enough-Access basis, and revoked automatically at the end of the session; (c) sessions are recorded in full and retained for at least 12 months; and (d) privileged secrets and passwords are rotated on a schedule and, where necessary, after each use.
Article 9. Service and non-human accounts
9.1. Service accounts are individually identified, granted least privilege and not used for interactive logins; their secrets are rotated on a regular schedule and managed centrally; anomalous activity is monitored.
PART IV – ACCESS LIFECYCLE AND REVIEW
Article 10. Access lifecycle (joiner-mover-leaver)
10.1. Joiner (new hire): accounts and role-based permissions are approved and issued before the first working day; information security training is completed before production system access is granted.
10.2. Mover (position change): review and adjust permissions when staff move between departments or roles; revoke old permissions that are no longer needed (avoiding privilege creep).
10.3. Leaver (resignation/end of contract): disable the account and revoke all access same day termination (for high-risk cases: immediate deactivation); recovery of devices, tokens and certificates; handover of work data.
Article 11. Periodic access reviews
11.1. Access reviews: every 6 months for standard systems; every 3 months for privileged accounts and systems that process RESTRICTED data. The system owner re-confirms that each entitlement remains appropriate; entitlements that are no longer needed are revoked.
11.2. Review findings are recorded and reported to the Information Security Committee (ISC).
Article 12. Customer access control
12.1. HiTechCloud provides the Customer with account access management tools: creating sub-accounts with restricted permissions; enabling MFA; and viewing login logs. The Customer is responsible for managing the permissions of its sub-accounts and end users in accordance with Article 4 of the Terms of Service.
12.2. HiTechCloud personnel access Customer environments/data only when necessary to provide the service or technical support, following the principle of least privilege, with logging in place and in compliance with PDPD and the Technical Support Terms (passwords are never requested via email/chat; temporary access grants are preferred).
PART V - MONITORING, ENFORCEMENT, AND EFFECT
Article 13. Access monitoring and logging
13.1. All access to critical systems and CONFIDENTIAL/RESTRICTED data is logged centrally (SIEM), integrity-protected and retained for at least 12 months.
13.2. The system raises alerts on anomalous behavior (logins unusual in location or time, privilege escalation, bulk access); critical alerts are escalated to the Incident Response (IR) process.
Article 14. Handling violations
14.1. Violations of the IAM Policy (account sharing, abuse of privilege, intentional unauthorized access) are handled under the Information Security Policy and internal regulations; conduct showing signs of a criminal offense (unauthorized access, data misappropriation) may be prosecuted under Articles 285–294 of the Penal Code 2015 (Bộ luật Hình sự 2015), as amended in 2017.
Article 15. Effect
15.1. This Policy takes effect on 1 July 2026 and is reviewed at least once every 12 months. The Vietnamese version prevails as the legally binding text.
