Provisioning and Deprovisioning Policy
Version 2.0
For Students, Faculty, Staff, Guests, Alumni
Purpose
The purpose of this policy is to establish requirements for the issuance, modification, review, suspension, and revocation of access to University IT Resources for person and non-person entities affiliated with the University.
Scope
This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.
Policy Statement
- Access to University IT Resources must be granted only to authorized persons and non-person entities based on a valid University business, academic, or operational need and the Principle of Least Privilege.
- Access privileges must reflect assigned responsibilities and authorized security or privacy level.
- Provisioning or deprovisioning must follow a documented account-management process that addresses request, approval, creation or activation, modification, periodic review, suspension or disabling, and removal.
- Requests to create or materially change access must be approved by an appropriate supervisor, sponsor, system owner, or other authorized University representative before access is granted.
- Fordham username (i.e., individual default) accounts must be limited to approved uses based on role.
- Access rights and account status must be reviewed periodically and when an individual’s role, affiliation, business need, or authorized access changes.
- Access that is no longer required or appropriate must be removed or modified promptly.
- Designated accounts such as Corporate, Generic, service, administrative, and other non-person accounts must be formally authorized, limited to approved uses, assigned to a responsible owner, and reviewed.
- Credentials must be changed when a User with knowledge of those credentials no longer requires access, or when compromise is suspected.
- Responsibilities for requesting, approving, provisioning, and reviewing access must be separated where practical to reduce conflicts of interest and unauthorized privilege changes.
- When an individual’s role or affiliation is modified or terminated, or access is no longer required, it is the responsibility of the managing supervisor (or higher) to notify Human Resources and the IT Service Desk, as applicable, before the effective status change.
- Required access changes must be completed by the effective date and time of the change.
- Upon termination or separation, applicable system access must be disabled or removed, associated authenticators and credentials must be revoked as appropriate, and University system-related property and access media must be returned in accordance with applicable University procedures.
- All provisioning and deprovisioning requests and resulting account lifecycle actions must be recorded in ServiceNow or another University-approved system of record to support review, auditing, and compliance.
- Access to University IT Resources is subject to monitoring and logging in accordance with applicable University policies.
- IT Resources that do not use centrally managed services (e.g., Central Authentication Service) or do not have an automatic provisioning/deprovisioning process in place must be manually provisioned or deprovisioned by the responsible individual(s) by the effective date and time of the change (e.g., termination, separation, or role change).
- Non-centrally managed accounts include but are not limited to:
- Service accounts,
- Administrative accounts,
- Educational Technologies and Research Computing accounts,
- Database accounts,
- Application-based accounts, or
- Corporate and Generic Accounts.
Definitions
Corporate Accounts are departmental or group email accounts.
Deprovisioning is the term used when account access is suspended or disabled from use.
Fordham username is an identifier used to access University systems. A username may have multiple role-based email accounts associated with it; access to services depends on role.
Generic Accounts are considered accounts not derived using the faculty, staff, or student naming convention. There is no corresponding ID associated with a Generic Account. These accounts do not identify the person or entity using the account. See the Generic Account Policy.
IT Resources include computing, networking, communications, application, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services.
Principle of Least Privilege is the cybersecurity practice that individuals should have access to only IT Resources and functions required to perform their stated duties.
Provisioning is the term used to create or provide specific accounts and applicable access.
Related Policies and Procedures
NIST SP 800-53 Rev. 5 Alignment
- Access Control: AC-2 Account Management; AC-5 Separation of Duties; AC-7 Unsuccessful Logon Attempts; AC-11 Session Lock; AC-12 Session Termination; AC-16 Security and Privacy Attributes.
- Personnel Security: PS-2 Position Risk Designation; PS-8 Personnel Sanctions.