Network Trace
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

05) Does your organisation have a documented process for provisioning user accounts for all of your IT services that includes appropriate authorisation and secure account creation with unique user IDs?

August 30, 2022
IT Operations
Secure Logon

Answer yes if your organisation requires all users to have a secure and unique logon to access corporate endpoints, networks, and third party services, and if these logons are provisioned securely and with line manager authorisation. Please describe the provisioning process in the notes or provide a supporting document (as a PDF file) as evidence. If any generic or shared accounts are used, please specify what these are used for and any processes you have in place to minimise their usage.

Your users need to be provisioned their access to your organisations IT systems in a secure manner. Each user must have a unique user ID (username) and password.

When provisioning access to users the level of access given should be the minimum required for the user to perform their job role and should only be provisioned with line manager approval.

User provisioning is generally done via the use of a controlled and auditable central user management system to grant, modify, and terminate access, such as an Active Directory.

How to implement the control

Your IT team must ensure that the process used to provision access to new employees is robust and secure. A review by an external security consultant can help here.

All users must be provisioned with unique user IDs and passwords. If temporary passwords are issued to users when they first log in, the systems must enforce a password change.

If you would like to contribute to this article or provide feedback, please email Contributors will be recognised on our contributors page.

Pattern Trapezoid Mesh

Defend against supply chain attacks with Defend-As-One.

No organisation is an island.