IS-02:AC-09

BYOD mitigated via cloud-only access, MFA, RBAC, session revocation

Status

Event-driven

Policy cadence

Continuous

Last evidence

—

Next due

—

Owner

CTO / Head of People

TSC

CC6.1

Evidence folder

02_Access_Reviews

Automatable

No — human judgement

Policy

IS-02

Policy version

v11 (2026-04-09)

Not automatable. DeftTrust schedules this control, prepares the pack and files the record it produces — it does not perform the judgement. The calendar still tracks it, so it cannot silently lapse.

Collectors

Collector	Relationship	Samples	What it observes
No collector references this control yet.

Evidence satisfying this control

Collected	Collector	Result	Source	Digest
No artifact satisfies this control.