Policy 7230A - Department of Administration

4.2.1.2 Review User Accounts and Account Permissions
Perform user account review at a pre-determined interval to ensure
that users are provided with appropriate accounts and account
permissions:
• Validate each system user’s positional role within the
organization.
• Review system accounts and account permissions for each
user.
• Validate that each user’s account and account permissions
meets the requirements established by positional role.
4.2.1.3 Update Accounts to Reflect Change in Requirements
Should account review determine that users have insufficient
accounts or account permissions, the required accounts and/or
permissions must be provided:
• Where accounts exist but permissions are insufficient, modify
the account to include appropriate permissions as per the
requirements of the positional role.
• Where accounts do not exist, create accounts with
appropriate permissions as per the requirements of the
positional role.
• Review created accounts and assigned permissions to ensure
they meet the requirements of the positional role.
4.2.1.4 Disable and Remove Extraneous Accounts and Permissions
Should account review determine that users have inappropriate
accounts or account permissions, those accounts and/or permissions
must be rescinded:
• Eliminate extraneous permissions in allowed accounts.
• Revoke access to, and eliminate permissions in extraneous
accounts.
• Review system logs to catalogue the activity of the account.
• Assign short-term access with review only privileges to the
user’s immediate manager to allow for investigation and
review of any data that may have been created/modified.
• At the request of the account assignee, provide copies of any
data exclusively owned by the account to the account
assignee.
• Upon completion of all review and investigation, permanently
delete any extraneous accounts.
8