Authentication & Authorisation Standard¶


Distribution	Relevant Personnel (Employees and Contractors); Clients upon request
Version	1.0
Approved	2026-03-25
Approved by	Arran Corbett

Authentication¶

These are the company password and authentication requirements:

Minimum password or passphrase length of at least 16 characters
Minimum of 3 of the following parameters: upper case, lower case, numeric, or special characters
Maximum password age of 1 year
Minimum password age of 1 day
A procedure in place for changing of password or passphrase upon detection of suspicious activity or incident
A maximum of 5 invalid logon attempts before account lockout
Locked accounts must be unlocked by an administrator

Multi-factor authentication must be enabled on any internet facing systems and source code repositories.

Secret Server is to be used for storing credentials as required.
In-browser credential storage is not to be used.
Secrets managers / keychains should be used to store credentials required for source code purposes.
Authorised exchange of credentials must be performed using the Sensitive Information Sharing Procedure.

Upon authorisation to access certain data due to role, a user is granted access to locations using the following mechanisms:
- Being added to an Active Directory Security Group (or equivalent permission structure)
- Being securely provided with text credentials / API keys
When authorisation to access certain data is removed, the Security Groups / API key access should be removed / rotated.
Authorisation provision and revocation is logged in the system name system.