Policy 7230A - Department of Administration

copy of the signed document will be provided to the individual with the original being
retained by the appropriate Human Resources department.
11.2 Personnel Operations
The State of Kansas requires that the manner in which information system users are
hired, fired and transferred between positions be performed in a structured and
controlled manner.
By following defined protocols regarding staffing, the State of Kansas ensures that the
users to whom it extends information system access will understand and treat that
access with appropriate regard for information security. The potential exists that,
without these protocols, information system users will have insufficient regard for the
security of the information systems or information they use, increasing the risk that
the State is required to accept.
State agencies are required to define categorizations (also known as system roles) into
which all of the users of State information systems must be placed. These system roles
will be used for all information system users, whether they are employees or third
party users, whether they work for the State itself or one of its agencies..
Each system role will have assigned to it a risk categorization. Risk categorizations will
define the amount of security risk associated with any given system role. The State
requires the use of appropriate personnel screening procedures and background
checks when staffing positions according to the risk categorization assigned to the
system role. Both system roles and risk descriptions will be reviewed and updated
where required by the State on an at least annual basis.
Upon commencement of work for the State of Kansas, employees and third party
users will be required to sign appropriate access agreements (including but not limited
to non-disclosure, non-compete, conflict of interest, acceptable usage, etc.). These
agreements specify the user’s intent to abide by the operational and security
requirements of the State. These agreements will be reviewed on an annual basis and
resigned by information system users as required. Further, the agreement
document(s) will be reviewed on an at least annual basis to ensure the highest level of
appropriateness and applicability.
Should the user of a State information system, whether internal employee or third
party user, change working location or functional system role while in the employ of
the State, the access and operational privileges of that user will be immediately
reviewed and, where required, updated. This review and update will focus equally on
eliminating access privileges no longer required as well as providing the net
new/enhanced access required of the new functional role. As necessary, State
property, temporarily in the possession of the information system user, will be
returned.
Should the user of a State information system, whether internal employee or third
party user, leave the employ of the State, access accounts for all information systems
35