DG Access Procedures

• Everyone has a responsibility for preventing unauthorized access to Organizational Data and Information Systems.
  1. Associate Data Trustees, Data Stewards, and Associate Data Stewards have a responsibility to assign appropriate access to Organizational Data.
  2. System Owners, Technical Managers, and Data Administrators have a responsibility to provision assigned access to Information Systems and work with Cyber Security to secure those systems.
  3. Data Users have a responsibility to keep their access to Organizational Data and Information Systems private and secure.
• Data Stewards and Data Administrators must publish instructions for how to request access (new access, a change to access, or removal of access) to an Information System.
• Data Stewards must analyze Data User roles and determine the level of access required to perform a job function based on the Principle of Least Privilege.
• Data Stewards must analyze authorization roles to ensure they are free from Separation of Duties conflicts.
• Granted access must be used only for the purpose for which it was originally intended and only for the Data User who was originally approved.
• Access policies, principles, and procedures apply to both Individual Accounts and Service Accounts.
• Additional training may be required by a Data Steward and/or a System Owner before access is granted.

• Data Stewards must ensure appropriate resources are available and maintained to adequately authenticate, assign, and verify access. Data Stewards must notify Associate Data Trustees of any resource constraints.
• Technical Managers must ensure appropriate resources are available and maintained to adequately authenticate, provision, and verify access. Technical Managers must notify System Owners of any resource constraints.
• The Chief Information Security Officer must ensure appropriate resources are available and maintained to prevent and detect unauthorized use of Organizational Data and Information Systems.

1. A request for new access to an Information System should follow published instructions. The request must include the Data User’s name, account name (e.g., GT Account), job title, and job function as it relates to the Information System. Access to an Information System may require additional approvals (e.g., a Data User's supervisor or director). Access to an Information System may also be granted through pre-approved role-based permissions.
2. The Information System may contain one or more Data Domains or Data Sub-Domains of Organizational Data. Each applicable Data Steward must review the request and if approved determine the level of access required to perform the job function. Based on published instructions, the Associate Data Trustee, the System Owner, and/or the Technical Manager may also play a role in reviewing the request and determining its rejection or approval.
3. Each Data Steward must coordinate with the Data Administrator to review the approved request and determine the necessary authorization role(s) to grant access. The Data Administrator must provision the approved authorization role for the Data User in the Information System.
4. Data Stewards and Data Administrators must keep record of the request details, the approved level of access, and the provisioned authorization role for auditing purposes.
5. The Data Administrator must notify the Data User and their supervisor or director of the provisioned access.

1. A request to change access to an Information System should follow published instructions. The request must include the Data User’s name, account name (e.g., GT Account), job title, and job function as it relates to the Information System. Access to an Information System may require additional approvals (e.g., a Data User's supervisor or director). A change in access to an Information System may also be granted through pre-approved role-based permissions.
2. The Information System may contain one or more Data Domains or Data Sub-Domains of Organizational Data. The Data Administrator must provide each applicable Data Steward a listing of the Data User’s active authorization roles to inform current access.
3. Each Data Steward must review the request and if approved determine the level of access required to perform the job function. Based on published instructions, the Data Trustee, the System Owner, and/or the Technical Manager may also play a role in reviewing the request and determining its rejection or approval.
4. Each Data Steward must coordinate with the Data Administrator to review the approved request and determine the necessary authorization role(s) to grant access. The Data Administrator must provision the approved authorization role for the Data User in the Information System.
5. Data Stewards and Data Administrators must keep record of the request details, the approved level of access, and the provisioned authorization role for auditing purposes.
6. The Data Administrator must notify the Data User and their supervisor or director of the provisioned access.

1. A request to remove access to an Information System should follow published instructions. The request must include the Data User’s name, account name (e.g., GT Account), and access removal effective date.
2. The Information System may contain one or more Data Domains or Data Sub-Domains of Organizational Data. The Data Administrator must provide each applicable Data Steward a listing of the Data User’s active authorization roles to inform access that will be removed.
3. The Data Administrator must remove all authorization roles for the Data User in the Information System on the requested access removal effective date.
4. Data Stewards and Data Administrators must keep record of the request details and the removed authorization roles for auditing purposes.
5. The Data Administrator must notify the Data User’s supervisor or director confirming removal of access.

1. Human Resources must notify Data Stewards and Data Administrators of any employment terminations.
2. The Information System may contain one or more Data Domains or Data Sub-Domains of Organizational Data. The Data Administrator must provide each applicable Data Steward a listing of the Data User’s active authorization roles to inform access that will be removed.
3. The Data Administrator must remove all authorization roles for the Data User in the Information System. This must be done within five business days of termination.
4. Data Stewards and Data Administrators must keep record of the termination and the removed authorization roles for auditing purposes.
5. The Data Administrator must notify the Data User’s supervisor or director confirming removal of access.

1. Human Resources must notify Data Stewards and Data Administrators of any employment status changes which requires a change to such employee’s access to Organizational Data and Information Systems. Employment status changes include change in job function, job status, and transfer to another unit.
2. The Information System may contain one or more Data Domains or Data Sub-Domains of Organizational Data. The Data Administrator must provide each applicable Data Steward a listing of the Data User’s active authorization roles to inform current access.
3. The Data User’s supervisor or director and each Data Steward and Data Administrator must coordinate a review of access to determine which authorization roles remain appropriate and which need to be removed from Information Systems. This must be done within thirty calendar days of employment status change.
4. Data Stewards and Data Administrators must keep record of the employment status change and the added and/or removed authorization roles for auditing purposes.
5. The Data Administrator must notify the Data User’s supervisor or director confirming changes to access.

• System Owners, Technical Managers, and Data Administrators must be able to generate a list of Data Users granted access to an Information System.
• Data Stewards and Data Administrators must review Data User access to Information Systems at least every six months and document findings.
• Data Stewards and Data Administrators must create, document, maintain, and periodically review procedures related to access, including:
  1. Instructions for how to request access to an Information System
  2. How authorization roles are reviewed and assigned using the Principle of Least Privilege
  3. How authorization roles are reviewed to ensure they are free from Segregation of Duties conflicts
  4. Processing requests for new, changes to existing, or removal of access
  5. Auditing of access
• Human Resources, Data Stewards, and Data Administrators must create, document, maintain, and periodically review procedures related to access, including:
  1. Employment terminations
  2. Employment status changes
• Data Stewards and Data Administrators must maintain documented evidence that the procedures related to access are actively used and effective.

Certain Georgia Tech groups are given pre-approved read-only access to Organizational Data and Information Systems due to their job function. This approval is granted by the Data Governance Committee and is reviewed on a periodic basis. A listing of these approved groups can be found in the resource section.

To request access based on pre-approval, the following steps must be completed:

1. The director or manager of a pre-approved group must send the Data Administrator of the Information System a request to grant read-only access for one or more Data Users in their group. The request must include the Data User’s name, account name (e.g., GT Account), and job title.
2. The Data Administrator must provision access for the Data User in the Information System.
3. The Data Administrator must notify the Data User and the requestor of the provisioned access.
4. Data Administrators must keep record of the request details and the provisioned authorization role for auditing purposes.