Authorized Access Procedure

Version 1.3

For Staff, Guests

Purpose

The purpose of this procedure is to ensure proper governance and control over privileged or heightened administrative access, particularly for "a-" and "ta-" accounts. This procedure establishes a consistent method for requesting, approving, provisioning, and removing privileged access in accordance with the principles of least privilege and separation of duties. All such requests are processed via ServiceNow and receive the required approvals. 

Scope

This IT Security document and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked 

Procedure Statement

• Request Submission:  

All individuals must request privileged or heightened administrative access via ServiceNow.  

• For requests pertaining to Banner or Active Directory (AD).
• Active Directory
  • Click on Service Catalog
  • Select Administrative Services
  • AD Account/Group Request, Request new or make changes to an AD Account(s) or AD Group(s)
  • Answer the required fields on the form
• Banner
• • Banner choose the appropriate access request (e.g., Banner HR access, Banner Finance access)
  • Answer the required fields on the form
• All other requests call the Service Desk and be prepared to answer the following information:
  1. A clear and detailed business justification for the required access to support accountability and auditing.
  2. The request must identify the systems, applications, roles, or privileges for which access is requested and demonstrate alignment with the individual’s job responsibilities and the principle of least privilege.
  3. The request must include the required duration of access. Temporary or time-limited access must include an expiration date. 

Post-Approval Activities 

1. Upon approval, the service request is routed to the administrator responsible for provisioning the access.
2. Privileged access must be provisioned only to the systems, applications, roles, and permissions documented and approved in the ServiceNow request.
3. Privileged access must be assigned to an individually identifiable account and use University-approved authentication mechanisms.
4. Privileged access must be modified or removed when no longer required due to a change in job responsibilities, transfer, termination, expiration of temporary access, or other change in business need.
5. Privileged access must be periodically reviewed to confirm that access remains appropriate and consistent with the individual’s current job responsibilities and the principle of least privilege.
6. Privileged account activity must be logged in accordance with applicable University security requirements. 

Definitions

A- Account is an administrative account assigned to an individual employee whose job responsibilities require Privileged Access. 

IT Resources include computing, networking, communications, applications, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services. 

Privileged Access is access to systems or applications that exceed standard User permissions, allowing administrative or heightened control. 

ServiceNow is the IT Service Management (ITSM) system for tracking access requests, approvals, and related documentation.

TA- Account is a temporary administrative account assigned to consultants, vendors, or other external personnel who need time-based privileged access for specific tasks. 

Related Policies and Procedures

• Account Access Change Control Policy
• Emergency Access via Privileged Access Management Policy
• Non-Persistent Administrative Access Guidelines
• Privileged Access Control Policy

Implementation Information

Revision History