Security Practices: Access & Credential Management
Security practices are designed to protect systems, documentation, and client information while remaining practical and proportionate to the nature of the work.
Security by Design
Security considerations are incorporated at the point where processes, tools, and responsibilities are defined.
Rather than relying on corrective controls, GreenMethod prioritizes preventive measures such as:
clear separation of systems and data
explicit access ownership
approval-based access provisioning
strong authentication mechanisms
This approach reduces dependency on individual behavior and supports consistent application over time.
Credential Storage
All passwords, access keys, and authentication credentials are stored in a dedicated, protected credential management system.
This system:
is isolated from project documentation and operational tools
enforces role-based access control
is protected by multi-factor authentication (2FA)
is accessible only to explicitly approved employees
Credentials are never stored in documentation artefacts, project records, emails, or informal communication channels.
Access Control Principles
Access to systems and credentials follows defined principles:
access is granted based on role and operational need
least-privilege access is applied by default
access is time-bound where appropriate
access is reviewed and adjusted as responsibilities change
Convenience is not treated as a justification for expanded access.
Approval and Continuity Mechanisms
Access provisioning requires explicit approval.
A primary manager reviews and verifies access requests
A secondary manager is authorized to approve access in the absence of the primary approver
This dual-approval arrangement prevents single points of dependency while maintaining accountability.
Access approvals are documented, and changes are traceable.
Relationship to Projects and Delivery
Access is aligned with project roles and responsibilities.
As projects progress:
access is granted when required
adjusted when scope or responsibilities change
revoked when no longer necessary
This ensures that access remains appropriate throughout the delivery lifecycle.
Incident Awareness and Responsibility
Employees are responsible for:
safeguarding assigned credentials
reporting suspected compromise or misuse
adhering to defined access practices
Security incidents are treated as operational events and reviewed to identify corrective and preventive actions.
Scope and Disclosure
Public descriptions of security practices are intentionally high-level.
Specific configurations, tooling details, and operational parameters are not disclosed publicly to protect system integrity and reduce exposure.
Internal Security Indicators
To validate the effectiveness of access and credential management, GreenMethod monitors internal indicators such as:
number of access requests requiring adjustment after initial approval
frequency of access reviews
timeliness of access revocation following role changes
adherence to authentication requirements
These indicators support governance review and continuous improvement.
Design Principle
Effective security is structured, explicit, and quietly enforced.
By embedding access control and credential management into normal operations, GreenMethod reduces risk without introducing unnecessary friction or procedural overhead.