12. Access Control

12.1 Glesys maintains and applies access control processes governing access to its network and information systems to ensure least privilege, need-to-know, traceability, and periodic review, including but not limited to:

a) access lifecycle, including documented granting, modification, and revocation processes with approvals and traceability;

b) annual access reviews performed by information owners, with completion documented in the system inventory;

c) multi-factor authentication requirements and stricter controls for privileged accounts; and

d) secured communication channels (including for emergencies).