Do you have a fully implemented policy or procedure that details how your employees obtain administrator access to institutional instance of the application?

This question is asking whether your organization has a formal, documented policy or procedure that specifically outlines how your employees can obtain administrator-level access to a customer's (institution's) instance of your application. Administrator access represents the highest level of privileges within an application, allowing users to make system-wide changes, modify security settings, access sensitive data, and potentially override controls. Because of these powerful capabilities, the process for granting such access should be carefully controlled. The security assessment is asking this question because improper administrator access management is a common source of security incidents. Without proper controls, there's risk of: 1. Unauthorized access to customer data 2. Accidental or malicious system changes 3. Compliance violations 4. Inability to properly track who made critical system changes A good answer should describe your formal, documented process that covers: - Who can request administrator access to customer instances - Who approves such requests - What justification is required - How access is provisioned - Time limitations on access (temporary vs. permanent) - Documentation and audit trail requirements - How access is revoked when no longer needed The policy should demonstrate that administrator access to customer environments follows the principle of least privilege and is properly controlled, documented, and audited.