---
document_id: BPS-POL-IAM-01
title: "Cloud Identity, Access & Cryptographic Control Policy (Synthetic Specimen)"
version: "2026.4"
effective_date: "2026-11-10"
next_review_date: "2027-11-10"
scenario_entity: "Acme Cloud SaaS Inc. (Synthetic B2B Reference Stack)"
perimeter: "AWS (eu-west-1 / us-east-1) · Okta Workforce Identity · GitHub Enterprise · Terraform IaC · AWS Bedrock LLM"
control_mappings:
  iso_27001_2022: ["A.5.15", "A.5.16", "A.5.17", "A.5.18", "A.8.2", "A.8.3", "A.8.5", "A.8.15", "A.8.24"]
  soc2_tsc: ["CC6.1", "CC6.2", "CC6.3", "CC6.6", "CC6.7", "CC7.2"]
  iso_42001_2023: ["A.6.2.6 (Annex B.6.2.6)", "A.7.4 (Annex B.7.4)"]
  eu_dora: ["Article 9(2)", "Article 9(4)(c)", "Article 9(4)(e)"]
linked_risks: ["RSK-04 (Unauthorized Privilege Escalation)", "RSK-11 (Cryptographic Key Mismanagement)"]
owner: "Head of Platform & Security Lead"
approver: "Chief Technology Officer (CTO) / ISMS Executive Sponsor"
classification: "INTERNAL  -  AUDIT & CUSTOMER SECURITY REVIEW READY"
approval_status: "SPECIMEN ARTIFACT  -  SYNTHETIC CLOUD STACK"
---

# Document Control Header (ISO/IEC 27001:2022 Clause 7.5.2)

| Attribute | Controlled Value |
| :--- | :--- |
| **Document ID** | `BPS-POL-IAM-01` |
| **Version & Status** | `v2026.4` · Approved Reference Specimen (Synthetic Stack) |
| **Effective / Next Review Date** | `2026-11-10` / `2027-11-10` (Annual Cycle or Major Stack Change) |
| **Functional Owner** | `Head of Platform & Security Lead` |
| **Executive Approver** | `Chief Technology Officer (CTO)` |
| **Linked SoA & Risk Rows** | `BPS-SOA-01.xlsx` (`A.5.15-A.5.18`, `A.8.2-A.8.5`, `A.8.15`, `A.8.24`) · `RSK-04`, `RSK-11` |

# 1. Purpose & Architectural Scope

This consolidated operational policy governs workforce, contractor, and machine-identity authentication, privileged authorization, session logging, and cryptographic key management across the production cloud perimeter (`AWS eu-west-1` and `us-east-1`), federated identity provider (`Okta Workforce Identity`), source-code repositories (`GitHub Enterprise`), and scoped AI foundation model endpoints (`AWS Bedrock`).

> **Specimen Notice:** This document is a redacted architectural specimen produced by **The Blueprint In Studio** (`theblueprintinstudio.com`) illustrating bi-directional traceability between `BPS-SOA-01.xlsx` (93-Control Statement of Applicability & Risk Register) and operational policy rules. Conditional parameters (such as AI endpoint controls in §4.2) are bound to the client's actual stack during written intake.

# 2. Normative Control Mapping Matrix

| Policy Section | Control Requirement | ISO/IEC 27001:2022 | AICPA SOC 2 TSC | ISO/IEC 42001 (Annex A) / DORA | Target Evidence Artifact |
| :--- | :--- | :--- | :--- | :--- | :--- |
| **§3.1 Workforce SSO & MFA** | Hardware FIDO2/WebAuthn MFA enforced on all IdP logins | Control A.5.16, A.5.17 & A.8.5 | CC6.1 | DORA Art. 9(4)(c) | `EVD-IAM-OKTA-MFA.json` |
| **§3.2 Privileged JIT Access** | Short-lived AWS IAM Identity Center STS tokens (<= 4h / 1h) | Control A.5.15 & A.8.2 | CC6.2 & CC6.3 | ISO 42001 A.6.2.6 | `EVD-AWS-SSO-ROLES.xlsx` |
| **§3.3 Production SSH Ban** | Interactive SSH disabled; AWS SSM Session Manager logged | Control A.8.3 & A.8.15 | CC6.1 & CC7.2 | DORA Art. 9(4)(e) | `EVD-SSM-AUDIT-S3.log` |
| **§3.4 JML & Access Reviews** | 4h leaver revocation + quarterly privilege recertification | Control A.5.18 | CC6.2 & CC6.3 | DORA Art. 9(4)(c) | `EVD-IAM-Q4-REVIEW.xlsx` |
| **§4.1 KMS & TLS Cryptography** | AES-256-GCM via customer-managed AWS KMS CMKs + TLS 1.3 | Control A.8.24 | CC6.1 & CC6.7 | DORA Art. 9(2) | `EVD-KMS-ROTATION.json` |
| **§4.2 AI Endpoint Isolation** | Scoped IAM execution roles & zero-retention Bedrock APIs | Control A.5.15 & A.8.24 | CC6.6 | ISO 42001 A.6.2.6 & A.7.4 | `EVD-AI-BEDROCK-IAM.json` |

# 3. Identity & Access Engineering Rules (A.5.15 - A.5.18 / CC6.1 - CC6.3)

## 3.1 Workforce Federation & Phishing-Resistant MFA (A.5.16, A.5.17, A.8.5)
1. All workforce members and authorized contractors must authenticate via centralized `Okta SAML 2.0 / OIDC` federation. Local IAM user accounts with static passwords or long-lived access keys in production AWS accounts are strictly prohibited.
2. Multi-Factor Authentication (MFA) is enforced using `FIDO2 / WebAuthn` hardware security keys or biometric platform authenticators. SMS and voice-call OTP factors are disabled across all administrative and engineering groups (`EVD-IAM-OKTA-MFA.json`).

## 3.2 Privileged Access & Just-in-Time (JIT) STS Sessions (A.5.15, A.8.2)
1. Production cloud access is provisioned exclusively through `AWS IAM Identity Center` permission sets mapped to Okta security groups (`EVD-AWS-SSO-ROLES.xlsx`).
2. Maximum STS session duration is capped at **4 hours** for production read-only diagnostic roles and **1 hour** for elevated break-glass administrative roles, requiring prior ticket approval in the change management ledger (`BPS-POL-CFG-04`).

## 3.3 Production SSH Prohibition & Immutable Session Logging (A.8.3, A.8.15)
1. Direct interactive SSH (`port 22`) and RDP (`port 3389`) ingress rules are blocked at the VPC security group and AWS Network Firewall layer across `eu-west-1` and `us-east-1`.
2. Administrative command execution must traverse `AWS Systems Manager (SSM) Session Manager` with KMS-encrypted session transcripts streamed to an immutable `S3 Object Lock` audit bucket (`EVD-SSM-AUDIT-S3.log`).

## 3.4 Joiner-Mover-Leaver (JML) & Quarterly Access Certification (A.5.18)
1. Role provisioning follows least-privilege role-based access control (RBAC). Access requests require documented approval from the functional system owner prior to Okta group assignment.
2. Upon termination notification from HR, Okta SSO deprovisioning and active STS session revocation execute within **4 business hours**.
3. The `Head of Platform & Security Lead` conducts a formal **Quarterly Access Certification** (`EVD-IAM-Q4-REVIEW.xlsx`) covering all production AWS permission sets, GitHub Enterprise admin roles, and production database entitlements.

# 4. Cryptographic Key Management & Conditional AI Endpoint Controls (A.8.24 / ISO 42001 Annex A)

## 4.1 Customer-Managed KMS Encryption at Rest & TLS in Transit (A.8.24)
1. All production relational databases (`Amazon RDS PostgreSQL`), object storage buckets (`Amazon S3`), and backup snapshots are encrypted at rest using `AES-256-GCM` managed via customer-managed `AWS KMS` keys (`CMKs`) with automatic 365-day key rotation enabled (`EVD-KMS-ROTATION.json`).
2. All external and internal API traffic enforces `TLS 1.3` (or minimum `TLS 1.2` with ECDHE forward-secrecy cipher suites).

## 4.2 Conditional Module  -  AI Foundation Model Endpoint Isolation (ISO/IEC 42001 A.6.2.6 & A.7.4)
*Scope Binding Note: This section is compiled when ISO/IEC 42001:2023 or production AI/LLM systems are selected during Written Intake.*
1. Service-to-service workloads invoking `AWS Bedrock` foundation models authenticate exclusively via dedicated, least-privilege IAM execution roles restricting invocation to approved model ARNs within `eu-west-1` and `us-east-1` (`EVD-AI-BEDROCK-IAM.json`).
2. Vector embeddings and retrieval-augmented generation (RAG) indices are logically isolated per customer tenant and encrypted under tenant-scoped KMS keys (`BPS-AIM-01 §3`).

# 5. Policy Compliance, Exceptions & Version History

1. **Exceptions:** Any temporary technical deviation from this policy requires a formal risk acceptance entry in `BPS-SOA-01.xlsx` (`Risk_Register_5x5` tab) signed by the `Head of Platform & Security Lead` and `CTO`, with a mandatory expiration date not exceeding 90 days.
2. **Review Cycle:** Reviewed annually or upon material change to the cloud identity, KMS, or AI infrastructure.