Access Management SOP.
A lean access-control process for granting, reviewing, changing, and removing access before shared passwords become a company incident.
Editable DOCX · Copy in one click · No email gate
Operating standard
Control without the corporate sludge.
Owner
The security or operations owner; until assigned, the technical founder.
Response
Standard requests within one working day. Critical revocation immediately. Privileged changes within four business hours.
Metric
100 percent of departures revoked on time and zero shared administrator credentials.
If nobody owns the process, the founder owns every emergency.
Purpose
Give each person the minimum access needed, maintain accountability, and remove access promptly when roles change or people leave.
When it applies
Use for every employee, contractor, founder, vendor, service account, and production system from the moment access is requested until it is revoked.
Do not start blind.
Trigger to outcome. No meeting required.
- 01
Submit an access request naming the user, system, role, justification, and duration.
- 02
Confirm the manager and system owner approve the minimum permission level.
- 03
Create an individual account; never reuse another person's credentials.
- 04
Require multi-factor authentication and store recovery methods securely.
- 05
Record the grant in the access register and notify the user of acceptable use.
- 06
Review privileged access monthly and all other access quarterly.
- 07
Change access within one working day when responsibilities change.
- 08
Disable access immediately for involuntary departures and by end of the final day for planned departures.
Authority must be explicit.
Know when to stop.
Report suspected credential compromise immediately to the security owner. Disable the affected account first when delay increases risk, then investigate and document.
If it is not recorded, it did not happen.
Make the generic parts real.
How teams break the process.
Sharing one administrator login across the team
Granting broad access because it is faster
Removing email but forgetting cloud, code, billing, and vendor accounts
Related startup SOPs.
Make the process executable.
Download it, assign the real owners, set the thresholds, and test it with someone who did not write it.