Access control and cybersecurity in document management answer an essential question: who can view, change or delete each document, and how can the organisation prove it? On a platform that stores contracts, worker data and technical information, this question needs a precise answer.
In brief
- Access control rests on three elements: authentication, authorisation and logging.
- The principle of least privilege limits the impact of errors, compromised accounts and misuse.
- Permissions should follow defined profiles, not individual requests accumulated over the years.
- Regular access reviews and audit logs are what turn rules into evidence.
The three elements of access control
| Element | Question | Examples of controls |
|---|---|---|
| Authentication | Who is this person? | Individual accounts, multi-factor authentication, lockout after failed attempts |
| Authorisation | What can they see and do? | Profiles, permissions by folder, entity or document type, segregation of duties |
| Logging | What did they do and when? | Access, change and deletion logs, alerts for unusual behaviour |
The three elements depend on one another: if one fails, the others weaken. For example, well-designed permissions are worth little when several people share one account. In that case, nobody can tell who did what.
The principle of least privilege
Each user should only access the information they need for their role, and only for as long as they need it. Although it seems obvious, organisations often forget this principle in practice. An employee changes role and keeps the old access rights. A contractor finishes their contract, yet the account stays active. An administrator grants broad permissions to solve an urgent problem and never removes them.
Least privilege is therefore not a one-off setting. On the contrary, it is a discipline that requires regular review. At the same time, it reduces the impact of any incident, because a compromised account only exposes what it could access.
Profiles instead of exceptions
On a document management platform, the most robust way to manage permissions is to define profiles by role and assign each user to one. Typical profiles include document analyst, contract manager, HSE manager, contractor or auditor. As a result, permissions stay consistent, new accounts are quick to create and reviews become possible.
However, tailor-made permissions for each user soon create confusion. After a few years, nobody can explain why a given person sees certain information. For this reason, exceptions should stay rare and need a justification, an approval and an end date.
Segregation of duties
Some combinations of permissions create risks of their own. For example, one person should not submit a document for a contractor and then validate it. Nor should they change a record and delete its history. Likewise, platform administrators should not, as a rule, approve exceptions to the document process. Segregation of duties thus protects the organisation against errors and fraud. It also protects users themselves, because their actions remain clear and verifiable.
Encryption and data protection
Access control acts on who uses the platform. Encryption, on the other hand, protects data as it travels across the network and while it sits in storage, including backups. Together, these controls reduce the risk of exposure even when something fails, such as a stolen disk or an intercepted communication. With this in mind, the organisation should confirm that any platform it assesses encrypts data in transit and at rest. It should also know who manages the keys.
Audit logs: What to keep
- successful and failed access attempts, with date, time and origin;
- views, downloads, changes and deletions of sensitive documents;
- changes to permissions and profiles;
- validation and exception decisions.
Logs need protection against tampering and a defined retention period. However, keeping everything forever is not the answer: the period should match the purpose and, when logs include personal data, comply with the GDPR.
Regular access reviews
At least once a year, and after any reorganisation, area managers should check that their teams have the right access. Inactive accounts, contractor accounts with ended contracts and administrator permissions deserve special attention. In this way, the organisation corrects deviations before they become incidents.
Example: Access nobody removed
An HSE technician moves to another facility in a different region. Six months later, they can still see worker documentation from the old facility, including fitness-for-work certificates. Nobody removed their access, because the transfer request only covered the new permissions. However, an access review detects and corrects the situation. Without that review, the organisation would keep unnecessary access to sensitive personal data, which would be hard to justify to a supervisory authority.
Logical and physical access: The same logic
In many organisations, different teams manage access to the document platform and access control at the facilities. However, the logic is the same: only those who meet the defined conditions should enter. Therefore, it helps when an external worker’s document status feeds the physical access system. That way, what happens at the gate matches what the documentation says. In addition, when someone leaves, the organisation should deactivate the account and revoke the physical credential at the same time.
Common mistakes
- Shared accounts. Logs no longer identify who carried out each action.
- Accumulated permissions. People who change roles keep access they no longer need.
- Too many administrators. Every administrator account is a prime target for an attacker.
- Logs nobody checks. Without alerts or analysis, logs only become useful after the incident.
- Forgotten contractors. Accounts of companies that no longer work with the organisation remain active.
Indicators to monitor
- number of accounts with administrator permissions;
- accounts inactive for more than 90 days;
- percentage of accounts with multi-factor authentication;
- average time between a person leaving and the deactivation of their account;
- failed access attempts and alerts handled.
Together, these indicators give management a simple view of access control without requiring detailed technical knowledge.
Access control and cybersecurity: Implementation in five steps
- Classify information. First, identify which documents are public, internal, confidential or contain sensitive personal data.
- Define profiles. Next, link each role to a set of permissions, based on least privilege.
- Strengthen authentication. In addition, apply multi-factor authentication, starting with administrators and accounts with access to sensitive data.
- Enable logs and alerts. As a result, access and changes become traceable, and the system flags unusual behaviour.
- Review regularly. Finally, schedule access reviews and correct deviations.
Frequently asked questions
Who should approve permissions?
The information owner, usually the manager of the area that produces or uses it. The IT team carries out the configuration, but the decision on who needs to see what belongs to the business.
Should contractors have access to the platform?
Yes, when they submit and update their documentation. However, they should only see information about their own company and workers, with individual accounts and appropriate authentication.
What difference does a cloud platform make?
On a software-as-a-service platform, the provider is responsible for part of the security, such as infrastructure, encryption and backups. Even so, managing users, profiles and permissions remains the organisation’s responsibility. It is therefore worth clarifying in the contract who does what and how the organisation accesses audit logs.
How often should we review access?
In general, at least once a year for all users, and more often for administrator and contractor accounts. Reorganisations, mergers or changes of provider also justify extraordinary reviews.
Questions for senior management
- When did we last review access to the document platform?
- How many accounts have administrator permissions, and why?
- Can we tell who viewed a sensitive document in the last month?
Conclusion
In short, access control and cybersecurity in document management do not depend on a single technology. Instead, they rely on a coherent set of rules, profiles, logs and reviews. When these elements work together, the organisation protects its information and can also demonstrate that protection to clients, auditors and authorities.
Therefore, the best starting point is often the simplest one. List who has access today, confirm they need it and fix what makes no sense. Repeated regularly, this exercise already removes a significant share of the risk.
AISP-GEDOC supports companies with document management on digital platforms, including the definition of profiles, permissions and access rules.
See also: Authentication in corporate document management and Audit logs in document management platforms.
Further reading: Document management: A complete guide for companies.