Will granting access to data without owner approval set a bad precedent?

Question

I work for a small company that does contract work that involves storing customer data on our servers for the duration of a project. We recently adopted more strict folder security in which each team can only access their own folder. For example, Team A from location 1 cannot access Team B's data, nor can they access their sister Team A's data at location 2. This mimics the customer's folder security and is how I was instructed by my boss, the director over the account, and a manager representing the team with the most sensitive data.

As one would expect, I have since received multiple requests to grant additional access. I have insisted that the manager over the team, the closest we have to the owner of the data in the target folder, provide written approval of the requests. Each time, my team lead has told me that it is a waste of time and to grant access because it was allowed on the old server. Each time, I have insisted. My boss sides with my team lead because he believes my team lead will make the right call.

Am I wrong in thinking that IT granting access to customer data without owner approval (or as close as we have to it) sets a bad precedent? More specifically, can it jeopardize future adoption of ISO 27001 or NERC standards?

Answer 1

To answer your question about ISO 27001; ISO accreditation is based on practices and processes in effect at the time of audit. If the original process was to leave all sensitive data on a USB stick in the middle of the room and now you change the process and put in proper access controls, rights management, etc., then your ISO accreditation will be based on what you are doing right now.

If on the other hand the boss is routinely bypassing the security measures during and after the audit then you wouldn't get ISO accreditation.

In your particular scenario I would suggest establishing share zones between each pair of teams so that permissions still remain strong but controlled access can be granted. Once the share zone is established the choice of what to share moves from IT's responsibility to the group's manager. If a document needs to be removed from the zone then that can also be done easily. Concerns about users being lazy and dumping everything in share zones are the manager's problem.