User Access Management Procedure

The objective of the User Access Management Procedure is to define the actors and processes to grant/revoke/modify users access rights, together with a method of reviewing and re-confirming the user’s list and specified permissions (profiles/ access rights) for all applications used within the Company.

User administration is a technical control that must be implemented to ensure information security and authorized access to systems is maintained. Identification is the mean by which a user provides a claimed identity to a system. Authentication is the mean by which this claim is validated. An identifier or user ID is usually a series of characters that are used to attempt log-in to a system. Until the user authenticates himself he will have no access to the system. The identifier is a mechanism to allow the user controlled access to various resources, files, directories, printers on the system. The identifier must be unique to the user so that he can be held accountable for any actions performed using that identifier. When the user changes his role, is transferred or promoted, then he should have his access rights changed to reflect his new role. When the user leaves the Company, his user identifier should be immediately removed from the system.