Account Access Change Control Policy
Version 2.0
For Students, Faculty, Staff, Guests, Alumni
Purpose
The purpose of this policy is to ensure account access to IT Resources is reviewed and modified when changes in role, employment status, or operational need affect authorized access.
Scope
This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.
Policy Statement
- Authorized parties must review and modify an individual’s account access when a qualifying event occurs, including disabling or removing access as necessary to reflect current responsibilities and operational needs. Qualifying events include, but are not limited to:
- Change in role/position within a University department
- Transfer to another University department
- Retirement
- Non-working Leave of Absence (LOA)
- Employee’s job duties no longer require access to certain services or environments.
- The managing supervisor (or higher) must initiate required account access changes in accordance with the Deprovisioning and Provisioning Policy, including, but not limited to, employment separation.
- After a qualifying event, account access must be limited to the minimum access necessary for the individual’s current role and responsibilities.
Definitions
IT Resources include computing, networking, communications, applications, and telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services.
NIST SP 800-53 Rev. 5 Controls
AC-2 Account Management
AC-6 Least Privilege
PS-4 Personnel Termination
PS-5 Personnel Transfer
Related Policies and Procedures
- Authorized Access to Electronic Information Policy
- Authorized Access to Electronic Information Procedure
- Change Control Policy
- Emergency Access via Privileged Access Management Policy
- Non-Persistent Administrative Access Guidelines
- Provisioning and Deprovisioning Policy
Implementation Information
| Review Frequency | Triennial |
|---|---|
| Responsible Person | Senior Director of IT Security and Assurance |
| Approved By | CISO |
| Approval Date | March 1, 2017 |
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 07/28/2016 | Initial policy |
| 1.0.1 | 03/01/2017 | Grammatical changes only. No change to policy. |
| 1.0.2 | 5/22/2018 | Updated scope, disclaimer, definitions |
| 1.0.3 | 05/22/2019 | Updated related policies |
| 1.0.4 | 03/12/2020 | Updated related policies and changed the name of the policy for clarity |
| 06/22/2021 | Reviewed with no changes | |
| 1.1 | 09/08/2023 | Updated scope and policy disclaimer |
| 1.2 | 07/08/2024 | Updated purpose and policy statement |
| 1.3 | 04/17/2026 | Updated policy statement |
| 2.0 | 09/21/2026 | Revised account access change requirements; aligned to NIST SP 800-53 Rev. 5 controls AC-2, AC-6, PS-4, and PS-5; corrected prior control mapping. |
Policy Disclaimer Statement
Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity, with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.