Access Control
Last updated
Was this helpful?
Current Version
Last updated
Was this helpful?
FundApps implements physical and logical access controls across its IT systems and services in order to provide authorised, granular, audit-able and appropriate user access, and to ensure appropriate preservation of data confidentiality, integrity and availability in accordance with our Information Security Policy.
This policy covers all FundApps IT systems and information not classified as 'Public' in our .
Each information system is recorded in FundApps' which includes:
An owner responsible for managing user access
The types of data it holds and therefore the data classification and controls required to protect that information.
Status of basic controls such as SSO and two-factor
Access to each information system is on a least-privilege and as-needed basis. These are managed by the nominated owner of the system and access to each system is managed through FundApps' . These are reviewed as part of our monthly security stakeholder meeting.
FundApps' Identity and Access Management system allows to simplify and automate the on-boarding and off-boarding processes in terms of provisioning and de-provisioning accesses to systems.
Data stored in the FundApps platform is classified as 'FundApps Confidential' (see ).
Support staff access the platform through the same interface our clients do. As such, controls in place include:
Access via HTTPS only;
Named accounts using Single sign-on (SSO) and two-factor authentication;
Audit logs of support staff accessing the system, which is visible to our clients;
Access is granted on a least-privilege and need-to-know basis;
Ongoing ;
Access review by head of Client Services on a quarterly basis.
Additionally, we provide clients with the option to enable Just-In-Time (JIT) access feature. This is a dynamic access control method that allows our Client Services staff to have temporary permissions to a client's environment only when necessary and for the duration required to complete specific tasks.
JIT has a number of benefits:
FundApps staff do not have default access to client data.
Access is granted and revoked by clients with the Administrator role.
Application access is restricted to predetermined time periods and designated FundApps staff members only.
Access is time-limited, automatically expiring once the predetermined period concludes.
As is currently the case, access is documented in the audit trail.
It is important to note that if you ask us to enable JIT and subsequently fail to grant CS access for support purposes in a timely manner, this may result in missed service levels or other consequential issues for which we cannot be held responsible. It is imperative that all necessary access permissions are granted promptly to ensure our ability to meet agreed-upon service standards.
Access to our production network is restricted to a very small set of staff. Controls in place include:
All credentials and accounts are provisioned through a configuration change management system that requires approval of the change;
Access to the network must be made via a secure connection through the use of multi-factor authentication.
Each member of operational staff uses a named account to each server where access is required which is separately provisioned from the above network access;
Access is granted on a least-privilege and need-to-know basis;
Access is subject to Just-In-Time (JIT) and peer approval;
All access to and key administrative actions on production servers are logged to a centralised audit store;
Access review by CTO on a quarterly basis.
Named accounts are mandatory, unless an exception is granted by the data owner responsible.
Any built-in, default accounts should be disabled or renamed and passwords changed
Single-sign-on should be enabled and mandatory wherever possible
Two-factor should be enabled and mandatory whenever possible
Passwords should not be re-used across systems. Passwords should be stored using an approved password management tool with a strong master password.
Use secure passwords (minimum 12 characters in length).
Audit logs must provide non-repudiation for changes and access to FundApps Restricted and Confidential data
See our data classification policy for more information on the specific controls in place.
More information about JIT is available in our .
Our classifies data stored across all our IT Systems. Principles we follow include:
See .
FundApps encourages its clients to implement Single Sign-On in order to automate provisioning/deprovisioning of their accesses, and provide their users with a seamless authentication process. Alternatively FundApps supports two-factor authentication as well as traditional user/password credentials. More information is available on
In FundApps' platform, privileges are provided through roles which are assigned to users. More information on these roles and the privileges they grant is available on