Policy 7230A - Department of Administration

11.2.2. Hire Employees in a Structured Fashion
Upon initial hire, employee identity should be verified and accounts created
with appropriate access rights and permissions:
11.2.2.a Account and Permissions Provisioning and Review
• Account permission provisioning should be performed by one
dedicated set of administrators.
• Account and permission review should be performed by a
second set of dedicated administrators.
11.2.3. Transfer Employees in a Structured Fashion
Employees that change positions within the agency should be screened
according to their new position and have system account access and
permissions reviewed:
11.2.3.a Account and Permissions Revocation and Review
• Review access to revoked accounts should be provided for no
more than thirty days.
• Data transfer orders should be provided in writing and should
specify:
o The data to be transferred.
o The location to be transferred from.
o The location to be transferred to.
o The reason for the data transfer.
• Permanent deletion orders should be provided in writing.
11.2.3.b Account and Permissions Provisioning and Review
See section 11.2.2.a of these Non-Mandatory Baselines.
11.2.4. Terminate Employees in a Structured Fashion
Employee termination should include the recovery of all issued materials and
the closing of all established accounts:
11.2.4.a Account and Permissions Revocation and Review
See section 11.2.3.a of these Non-Mandatory Baselines.
11.3. Maintain Records
Agencies should capture documentation appropriate to personnel security processes:
• Maintain copies of all submission and screening documents for applicants that
are hired for future reference.
• Maintain copies of all completed access agreements.
• Maintain copies of all provisioned system access accounts and associated
permission.
• Maintain records of all issued agency owned materials.
• Maintain copies of all exit interview documents.
35