I work for a small company that does contract work that involves storing customer data on our servers for the duration of a project. We recently adopted more strict folder security in which each team can only access their own folder. For example, Team A from location 1 cannot access Team B's data, nor can they access their sister Team A's data at location 2. This mimics the customer's folder security and is how I was instructed by my boss, the director over the account, and a manager representing the team with the most sensitive data.
As one would expect, I have since received multiple requests to grant additional access. I have insisted that the manager over the team, the closest we have to the owner of the data in the target folder, provide written approval of the requests. Each time, my team lead has told me that it is a waste of time and to grant access because it was allowed on the old server. Each time, I have insisted. My boss sides with my team lead because he believes my team lead will make the right call.
Am I wrong in thinking that IT granting access to customer data without owner approval (or as close as we have to it) sets a bad precedent? More specifically, can it jeopardize future adoption of ISO 27001 or NERC standards?