User Access Management

Formal procedures have been established to manage the assignment of access rights to users. Procedures include steps to grant new access, modify existing access, and terminate access.

Procedures implemented for granting, modifying and revoking access to information systems.

• Additional authorization required for assignment of privileged access.
• Access is granted after proper authorization.
• All access (by applications, administrators and users, to software, databases and systems) is authenticated via unique user IDs and passwords.
• Systems are configured to conform to the following standards:
  • Account privileges configured to match the required user/system access responsibilities and follow the principle of “Least privilege”.
  • Passwords to applications and systems are stored using one-way encryption.
  • Users are required to change the initial password at first login.
• The following standards shall be followed when transmitting a password to a user:
  • Passwords shall not be disclosed to anyone other than the rightful owner of the user ID associated with the password or their manager during on boarding.
  • Protected information shall not be transmitted with the corresponding password.
  • Passwords shall not be stored in clear text. When storage is required by the user, passwords must be encrypted.
  • User identity shall be verified before performing password resets.
  • Privileged user access shall be periodically reviewed and re-authorized by the user’s manager. User access that is not re-authorized by the user’s manager will be removed.
• Physical and logical access to diagnostic and configuration ports shall be controlled

Manage Access Rights Process

https://www.lucidchart.com/invitations/accept/34789e97-9a10-4d4e-b313-5135c31500ec

Privilege Management

https://www.lucidchart.com/invitations/accept/d4c1dd94-4bc9-4c6b-8729-eb2904997611