Personnel, accessand lifecycle.

Who this covers

Everyone with access to Kenii source code, Kenii vendor-side services, or credentials issued by an institution. That includes contractors, who are held to the same terms.

Before access is granted

1. A signed agreement covering confidentiality, acceptable use, and ownership of work.
2. A written statement of what the person may access and why.
3. Review of this policy, the security policy, and the privacy policy.

Kenii does not currently run formal multi-state background screening. Where an institution requires it for personnel touching its environment, Kenii will arrange screening for the named individuals as a condition of that contract.

Access rules

• Access is granted to the least a person needs to do the work, and is time-bound where the work is time-bound.
• Institutional credentials are issued by the institution, never shared between people, and never reused across institutions.
• Multi-factor authentication is required on every account that supports it, including version control, hosting, and email.
• Credentials are stored in a password manager, never in code, documents, issues or chat.

When someone leaves

Same day, before the departure is announced:

1. Remove version control access and any deploy rights.
2. Revoke Kenii service accounts and email.
3. Notify every institution whose credentials that person held, and ask that they be revoked. Confirm revocation rather than assume it.
4. Recover or wipe company devices.
5. Rotate any shared credential that person could have seen.
6. Record the date each step completed.

Step 3 is the one that reaches outside Kenii, and it is the one that gets confirmed in writing.

Privileged access review

A twice-yearly review of privileged access is defined and scheduled: every account on every vendor-side service, every institutional credential held, and every version control collaborator. Anything without a current reason is removed, and each review is recorded with a date and a reviewer.

The first scheduled review has not yet been carried out. Kenii will not claim a completed review before one has happened, and this page will name the date once it has.

Security awareness training

Security awareness training is defined and scheduled for everyone with access, on joining and annually. It covers phishing, credential handling, safe handling of institutional data, and how to report an incident.

This training is not yet running, and no completion has been recorded. Kenii states that plainly rather than answering a questionnaire as though the control were already operating.