Account Management Standard

1 PURPOSE聽

Enterprise Technology & Services (ET&S) is charged by the 最快开奖直播搅珠结果 (最快开奖直播搅珠结果) to protect the integrity, confidentiality, and availability of systems and information. This standard establishes directives for managing the digital identity accounts that facilitate access or changes to 最快开奖直播搅珠结果鈥檚 information technology resources.

2 SCOPE聽

This standard applies to the following accounts issued from the 最快开奖直播搅珠结果:

2.1聽 Primary Account

Primary accounts are the most common account type. It is often referred to as the 最快开奖直播搅珠结果 username and password. All active faculty, staff, and students of GSC, KSC, PSU, UNH, and the 最快开奖直播搅珠结果 System Office are assigned a Primary Account, usually named after the individual (ex: firstname.lastname@yourinstitution.edu). Primary Accounts allow individuals access to 最快开奖直播搅珠结果 information technology systems, devices, and services, requiring single sign-on (SSO). Examples include Canvas, Microsoft Office 365, and Kronos. All Primary Accounts are subject to 最快开奖直播搅珠结果 Information Security Standards and Policies, and the individual to whom the Primary Account is assigned is responsible for the appropriate use of that account.

2.2聽 Secondary Account

The secondary account is also referred to as privileged or elevated access account. This is a second account with a different username and password that is assigned to an individual who has a business need that requires multiple accounts with varying levels of access (i.e., system administrators who require administrative accounts with elevated security permissions, which聽must be separate from those of their Primary Accounts). All Secondary Accounts are subject to all 最快开奖直播搅珠结果 Information Security Standards and Policies, and the individual to whom the Secondary Account is assigned is responsible for the appropriate use of that account.

2.3聽 Pool Account

This IT Account is controlled by a designated 最快开奖直播搅珠结果 employee, called the Guardian of the account, and is assigned to a specific person, called the account user (usually an hourly or temporary student employee), with a set expiration date. The Guardian of the account will supervise the use of this account, ensure that it is used in compliance with all 最快开奖直播搅珠结果 and all Information Security Standards and Policies, and work with the IT Account Administrators to maintain the records related to users of the Pool Account. The default expiration dates for Pool Accounts are set to the end of the current fiscal year (unless otherwise noted) but no longer than one year. Over time, the Pool Account can be re-assigned to several people but can never be assigned to more than one person at a time. Upon notification by the Guardian that the user of the account has left their position, IT Accounts Administrators will disable the Pool Account. When there is a new user who requires the use of the Pool Account, the Guardian is responsible for requesting that it be re-activated and re-assigned. All Pool Accounts are subject to this and all 最快开奖直播搅珠结果 Information Security Standards and Policies, and the individual to whom the Pool Account is currently assigned is responsible for the appropriate use of that account.

2.4聽 Sponsored IT Account

This type of primary account is assigned to a non-affiliate of the University who has business with 最快开奖直播搅珠结果 requiring access to IT resources. This includes, but is not limited to, volunteers, contractors, visiting students, and scholars. Sponsored IT Accounts require yearly approval and renewal by a President, Vice President, Provost, Dean, or Designated Sponsor Representative (DSR). All Sponsored IT Accounts are subject to this and all 最快开奖直播搅珠结果 Information Security Standards and Policies. The individual to whom the Sponsored IT Account is assigned is responsible for the appropriate use of that account.

2.5聽 Service Account

A service account is a dedicated account with escalated privileges for running applications and other processes. Service accounts may also be created to own data and configuration files. They are not intended to be used by people except for administrative operations.

3 STANDARD聽

Account management includes requesting, issuing, modifying, and disabling all 最快开奖直播搅珠结果 information technology accounts. All account access considerations shall be made per the 最快开奖直播搅珠结果 Access Management Standard.

3.1 Account Creation

3.1.1聽 Before creating user accounts, the sponsoring unit or division shall verify the user鈥檚 affiliation with 最快开奖直播搅珠结果.

3.1.2聽 Accounts are reserved for 最快开奖直播搅珠结果 faculty, staff, students, and applicants. Other individuals affiliated or otherwise needing 最快开奖直播搅珠结果 credentials shall request an account provisioned per the 最快开奖直播搅珠结果 Sponsored Account Standard.

3.1.3聽 Enterprise information technology account usernames shall conform to the 最快开奖直播搅珠结果 account username convention. 鈥� Accounts shall be provisioned following a role-based access scheme.

3.1.4聽 The principle of least privilege shall be applied when provisioning accounts. Users shall not be granted any more privileges than necessary for functions the user will be performing.

Non-privileged user accounts must be used and only elevated to root or Administrator when necessary. A secure mechanism to escalate privileges (e.g., via User Account Control or via sudo) with a standard account is acceptable to meet this requirement.
Privileged accounts must not be used for non-privileged activities.
最快开奖直播搅珠结果 enterprise administrative accounts are reserved for 最快开奖直播搅珠结果 employees with a demonstrated need聽
All privileged account activity is required to be logged and monitored per the 最快开奖直播搅珠结果 Log management standard.

3.1.5聽 Vendor or contractor accounts requiring elevated privileges shall make arrangements per the 最快开奖直播搅珠结果 Sponsored Account Standard and/or the Exception process.

3.1.6聽 There shall be one user associated with an account.

3.1.7聽 Account usage requires the account owners鈥� formal review acknowledging they have read and understood the 最快开奖直播搅珠结果 Acceptable Use Policy (AUP).

3.1.8聽 Devices must be configured with separate accounts for privileged (administrator) and nonprivileged (user) access.

3.2 Account Management

ET&S shall establish and maintain an inventory of all information technology accounts managed within 最快开奖直播搅珠结果.

The inventory, at a minimum, shall contain the user鈥檚 first and last name, username, start/ stop dates, and department.
When feasible, centralized authentication and account management shall be employed through the central 最快开奖直播搅珠结果 directory or identity service.

3.2.1 Account and Access Reviews

鈥� All active 最快开奖直播搅珠结果 privileged accounts shall be authorized on a recurring schedule, at a minimum annually.

鈥� Access modifications shall include valid authorization from appropriate administrative, academic, or business unit management and ET&S.

聽聽聽聽聽聽 o The Identity and Access Management team shall review active directory-privileged accounts.

聽聽聽聽聽聽 o The appropriate business unit leadership shall review local privileged/administrative accounts.

鈥� The employee's manager is responsible for reviewing employee accounts and access privileges with ET&S upon job changes (e.g., termination, position changes).

3.3 Account Protection

鈥� All accounts used to access 最快开奖直播搅珠结果鈥檚 information technology resource shall comply with the 最快开奖直播搅珠结果 Password Policy.

鈥� System administrator accounts shall use centralized authentication.

鈥� Central authentication systems should lock user accounts in accordance with industry best practices.

鈥� Administrators shall verify user identity prior to re-enabling or resetting user accounts.

鈥� Multi-factor Authentication (MFA) shall be implemented with all 最快开奖直播搅珠结果 administrator accounts. Exceptions will be granted based on operational need, such as a service account, or through the exception process.

鈥� In some cases, 最快开奖直播搅珠结果 users may be asked to provide identify verification when working with the ET&S team to validate the correct user and help prevent identity theft and/or fraud.

3.4 Disabling and Deletion of Accounts

Accounts out of compliance with the 最快开奖直播搅珠结果 Password Policy will be disabled and may be deleted.
All user accounts must be deprovisioned, and access attributes removed immediately upon separation unless a prior exception is in place. o Faculty leaving 最快开奖直播搅珠结果 in good standing may request access for up to 90 days past their last day of employment.

聽 o ET&S will assist users with data transfer upon request.

鈥� Self-service mechanisms may not be used to re-enable the account.

3.5 Local Administrative Accounts

In adherence to the cybersecurity principle of least privilege, ET&S will not enable local administrative rights on 最快开奖直播搅珠结果-owned systems by default. Individuals needing elevated privileges submit an exception request with a business justification.

DOCUMENT HISTORY

Drafted: 最快开奖直播搅珠结果 Cybersecurity GRC Reviewed by: 最快开奖直播搅珠结果 Cybersecurity Committee
Revision History: K Sweeney, December 14, 2023, section 4.3
- K Sweeney, May 30, 2024, formatting
Approved by: Thomas Nudd, Chief Information Security Officer