Guidance · HR
If you run HR
Most access problems start as an HR record that is late or missing. Your dates start every joiner, mover and leaver.
The decisions you'll be asked to make
When do we…
When must a leaver's access be removed, and what changes if they leave on bad terms?Remove a planned leaver's access, local accounts included, by the end of their last working day.
If…, then how…
If a contractor's engagement ends without HR knowing, then how do we catch it?Design it so HR never needs to know. Record every contractor in a sponsor register, with a sponsor and an end date, before any account exists, and set every account to expire at the end of that date.
How do we…
How do we set up a new starter's access before their first day?Create a starter's accounts only from HR's record or, for a non-employee, the sponsor register.
When do we…
When someone changes role, when do they lose their old access?Remove the old role's access on the move date. Where the old line manager recorded a handover before the move, the old access it names may stay until the handover ends, no later than 5 working days after the move date by the pack's default.
Who decides…
Who needs more than the standard awareness training, and what?Give everyone the baseline course, and add a role module wherever one mistake or one deceived person could cause serious harm.
What you own and what you hand on
From the Identity Lifecycle Responsibility Matrix P13-A08, in Joiner-Mover-Leaver & Access Provisioning.
The HR column.
You answer for it 2
RA-01 Record a joiner, mover, leaver or long absence in the HR record, with its date
Your side HR answers for it
Also involved: Line manager (consulted), IT service desk (told)
The rule, JML-01Every employee's account is created, changed, suspended and removed only from an event in the HR record, and every non-employee's only from the sponsor register. No account is created on a manager's request alone, and no account exists without a record in one or the other.
RA-10 Decide an urgent leaver and tell the service desk before the person is told
Your side HR answers for it
Also involved: Line manager (does it), IT service desk (told), Head of Information Security (told)
The rule, JML-09A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within 60 minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after 90 days, once their data has been dealt with.
Hand it on: you are consulted or told 3
RA-02 Record a non-employee in the sponsor register, with the reason and end date
Your side HR is consulted. Answers for it Sponsor
Also involved: IT service desk (told)
The rule, JML-10Every non-employee has a sponsor and an end date, recorded in the sponsor register before the account is created and no more than 12 months after the start. The account expires automatically at the end of that date. The sponsor is reminded 10 working days before, and only the sponsor can extend it, with a new end date. An engagement that ends early is a leaver the same day.
RA-03 Confirm which role profile a joiner or mover needs
Your side HR is consulted. Answers for it Line manager
Also involved: IT service desk (told)
The rule, JML-03Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every 12 months and after a reorganisation or a new core system.
RA-11 Recover equipment, badges and tokens, and change shared credentials
Your side HR is consulted. Answers for it Line manager
Also involved: IT service desk (does it)
The rule, JML-09A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within 60 minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after 90 days, once their data has been dealt with.
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.