Merge pull request #856 from Jonathan-Scott14/patch-8

Update principle-least-access.html.md.erb

source/standards/principle-least-access.html.md.erb

@@ -1,13 +1,15 @@
 ---
 title: Principle of Least Privilege
-last_reviewed_on: 2023-03-22
+last_reviewed_on: 2023-11-20
 review_in: 6 months
 ---
 
 # <%= current_page.data.title %>
 
 The [principle of least privilege][polp] involves setting up user accounts so they can only access and use the information they need for specific tasks. This can also apply to processes and individuals who might have to switch between normal access and the increased access of a superuser account as part of their work.
 
+All access provisioned for use within GDS must be provided on a least privilege basis
+
 Examples of privileged or higher security access are:
 
 - root access
@@ -24,13 +26,17 @@ You should use the principle of least privilege if you:
 
 Your team should:
 
-- make users aware of this policy and have a process for them to request changes to access as needed
+- make users aware of this policy and be required to confirm their understanding of their access privileges and related conditions of use
+- have a process for them to request changes to access as needed
 - define roles for users and grant required privileges, or access rights, for those roles
 - create the roles or credentials with the least possible privilege, with only necessary permissions required for normal users to perform their day-to-day jobs
 - use the role or credentials with the least possible privilege as the default option
 - use just-in-time (JIT) access provisioning to grant users an on-demand, time-limited privileged role or security token to access the privileged resources
 - make sure session time of the privileged access is set to no more than 12 hours, and/or terminates when the user logs out of their laptop
 - establish an audit trail for the use of privileged access
+- ensure approval and use of privileged accounts is kept to the absolute minimum necessary for a user to perform their job role
+- in cases where JIT access is not implemented for users with privileged access that have critical business impact, implement a documeneted periodic review (cadence to be defined) of the need to continually have these privileged access granted to confirmed users
+- have a Joiners, Movers and Leavers process, where line managers (or equivalent) arrange for privileged access to be removed (SLA to be defined) where it is not required. See this [NCSC guide on identity management](https://www.ncsc.gov.uk/guidance/introduction-identity-and-access-management) for more information.
 
 ## Examples