Policy 7230A - Department of Administration

• Review created accounts and assigned permissions to ensure
they meet the specifications as per the role.
11.2.3. Transfer Employees in a Structured Fashion
Employees that change positions should be reviewed according to their new
position and have their system accounts and permissions reviewed:
11.2.3.1 Conduct Employee Screening
Should an existing employee transfer to a position that carries a
higher risk categorization, additional background screening is
required. Additional screening is not required for transfer to a
position with either an equivalent or lower risk categorization:
• Review the risk level of the old and new roles and determine
whether the risk categorization increases or decreases.
• If risk categorization increases, conduct the appropriate
screening for a role of that risk categorization.
11.2.3.2 Review Assigned and Required Accounts and Permissions
Cross reference the accounts and permissions of the pre and posttransfer
roles, documenting where adjustments need to be made:
• Review positional role(s) to which the transferred employee
had been assigned and catalogue accounts and permissions.
• Review positional role(s) to which the transferred employee
will be assigned and catalogue accounts and permissions.
• Cross-reference the catalogued accounts an permissions,
noting which account(s) and permissions need to be
revoked/reduced, provisioning/enhanced, do not need to be
adjusted.
11.2.3.3 Revoke Accounts and Permissions that are no Longer Valid
The accounts of transferred employees that are no longer necessary
must be revoked to eliminate the possibility of illicit system access,
however the data the transferred employee may have created must
be preserved:
• Revoke access to and eliminate permissions within all
accounts assigned to the terminated employee.
• Assign access with review only privileges for all accounts
assigned to the transferred employee to that employee’s pretransfer
immediate manager for a pre-defined period of time.
• During this time and at the request of the account assignee,
provide copies of any data originally owned exclusively by the
transferred employee to the account assignee.
• Upon expiry of this time and at the direction of the Human
Resources department of the transferred employee,
permanently delete all accounts of the transferred employee.
39