Guidance · IT manager
If you're the IT manager who inherited security
Security landed on your desk with the servers and the service desk. These are the decisions people will bring you, and a clear line between what is yours to answer for and what you do, or are told, on someone else's behalf.
The decisions you'll be asked to make
Who decides
“Who decides” first, because the answer is often not you.
Who decides…
Who approves access that isn't in the role's standard profile?Two people approve it, both before anything is granted: the person's line manager, or the sponsor for a non-employee, and the owner of the system or data.
Who decides…
Who approves temporary administrator rights, and for how long?Someone independent of the user and of whoever grants the rights approves each elevation, by tier.
Who decides…
Who can approve deferring a patch, and for how long?Only a patch that will go in after its deadline needs a deferral, requested before the deadline for an accepted reason.
Who decides…
Who has the authority to take a production system offline?Write down before an incident who may take a system offline. In the pack, the incident manager may isolate a system, site or account at once; stopping a customer-facing service is the executive incident lead's decision, unless waiting would let the harm spread.
When it happens to you
The ones that tend to arrive on a Friday afternoon.
If…, then how…
If the scanner reports a critical finding on a system nobody owns, then who fixes it?The owner of your vulnerability standard assigns an owner straight away, because the finding's deadline is already running.
If…, then how…
If the only IT administrator also manages the security logs, then how do we control that?Treat it as a High conflict and take the logs out of the administrator's reach: forward them to a store the administrator can only read, and send alerts and a monthly activity review to someone else.
If…, then how…
If a server can't be rebooted to patch, then what are the options?Work through four options in order: patch one node at a time behind the service's redundancy, agree a short planned outage inside the deadline, use the vendor's live patching where it is supported, and only then mitigate and request a deferral before the deadline passes.
When do we…
When do we use a break-glass account, and what must happen afterwards?Use a break-glass account only when the normal administration route itself is unavailable, such as when every administrator is locked out.
If…, then how…
If an administrator uses their admin account for email or browsing, then what?Treat it as a possible exposure of the account's credential. Stop the use and end its sessions at once, change its password and revoke its tokens, check what it touched and what it did, and fix the cause within 1 month by the pack's default.
Setting it up with a small team
How do we…
How do we run a reliable monthly patch cycle with a small IT team?Run the same steps on the same days every month, counted from the vendor's release day, and let device management deploy the rings and force the restart.
How do we…
How do we control administrator access without a PAM platform?Build the privileged access rules with tools you already have: a separate administrator account per tier, security keys or passkeys, Tier 0 and Tier 1 rights that end by themselves, a vault for shared credentials, and logs administrators cannot change, reviewed by someone with no rights in the tier.
How do we…
How do we separate duties when there are only a few people?Separate the duties wherever you can, starting with the second approvals your bank and software already offer.
How do we…
How do we find and control service accounts nobody owns?Match every account whose password never expires, that runs a service or task, or that sits in an administrator group against your privileged account inventory.
What you own and what you hand on
From the Identity Lifecycle Responsibility Matrix P13-A08, in Joiner-Mover-Leaver & Access Provisioning.
The IT roles read as “you”: the IT service desk, the system administrator and the process owner, who in the pack's example is the Head of IT. Your organisation may set them differently. Where a provider runs your IT, it usually does the service desk and administrator work; the approvals, the process owner and accountability for the reconciliation stay inside your organisation.
You answer for it 5
RA-04 Build and keep each role profile
Your side Process owner answers for it
Also involved: System owner (does it), Line manager (consulted), Head of Information Security (consulted)
The rule, JML-03Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every 12 months and after a reorganisation or a new core system.
RA-07 Check resulting access against the conflict matrix before a grant
Your side IT service desk does it; Process owner answers for it
Also involved: Head of Information Security (consulted)
The rule, JML-06Before any access right is granted or changed, the person granting it checks the person's resulting access, everything they will hold after the change including what they still hold from an earlier role, against the Segregation of Duties Conflict Matrix (P02 SD-03). A grant that would create a conflict is not made unless it has been accepted under P02 SD-04.
RA-08 Create, change, suspend and remove accounts in single sign-on and connected systems
Your side IT service desk does it; Process owner answers for it
The rule, JML-14Every grant, change, suspension and removal is recorded in the access provisioning log with its request reference, the approvers, who made the change and when it was completed. A removal is recorded as complete only when it is confirmed in the system.
RA-12 Check a caller's identity before a password or factor reset
Your side IT service desk does it; Process owner answers for it
The rule, JML-13The service desk resets a password or a multi-factor authentication factor only after checking the caller's identity independently of the call, by one of the identity checks the Joiner-Mover-Leaver Operating Procedure sets. Information the caller gives is never enough on its own. The person is told of every reset through a second channel. Resets of privileged accounts follow the Privileged Access Standard.
RA-13 Discover systems outside single sign-on and decide each outcome
Your side Process owner answers for it
Also involved: Head of Information Security (does it), System owner (consulted)
The rule, JML-12Every system that holds accounts, including software bought with a card or signed up to with a work email address, is in the system inventory with an owner. Discovery runs every 3 months from card and expense spend, single sign-on and app-consent logs and the supplier register. Each system found is connected to single sign-on, or kept with its local accounts listed on the leaver checklist and in the reconciliation, or closed.
You do it, someone else answers for it 3
RA-09 Remove local accounts and access rights the service desk cannot reach
Your side IT service desk is consulted; System administrator does it. Answers for it System owner
The rule, JML-09A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within 60 minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after 90 days, once their data has been dealt with.
RA-11 Recover equipment, badges and tokens, and change shared credentials
Your side IT service desk does it. Answers for it Line manager
Also involved: HR (consulted)
The rule, JML-09A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within 60 minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after 90 days, once their data has been dealt with.
RA-14 Run the monthly reconciliation and report
Your side IT service desk does it. Answers for it Head of Information Security
Also involved: System owner (consulted), Campaign coordinator (told)
The rule, JML-15Within 3 working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within 1 working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11).
Hand it on: you are consulted or told 8
RA-01 Record a joiner, mover, leaver or long absence in the HR record, with its date
Your side IT service desk is told. Answers for it HR
Also involved: Line manager (consulted)
The rule, JML-01Every employee's account is created, changed, suspended and removed only from an event in the HR record, and every non-employee's only from the sponsor register. No account is created on a manager's request alone, and no account exists without a record in one or the other.
RA-02 Record a non-employee in the sponsor register, with the reason and end date
Your side IT service desk is told. Answers for it Sponsor
Also involved: HR (consulted)
The rule, JML-10Every non-employee has a sponsor and an end date, recorded in the sponsor register before the account is created and no more than 12 months after the start. The account expires automatically at the end of that date. The sponsor is reminded 10 working days before, and only the sponsor can extend it, with a new end date. An engagement that ends early is a leaver the same day.
RA-03 Confirm which role profile a joiner or mover needs
Your side IT service desk is told. Answers for it Line manager
Also involved: HR (consulted)
The rule, JML-03Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every 12 months and after a reorganisation or a new core system.
RA-05 Request non-standard access for an employee, with the reason and expiry
Your side IT service desk is told. Answers for it Line manager
The rule, JML-04Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than 6 months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date.
RA-06 Approve non-standard access to a system: the line manager for an employee or the sponsor for a non-employee, with the system owner
Your side IT service desk is told. Answers for it System owner
Also involved: Line manager (does it), Sponsor (does it)
The rule, JML-04Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than 6 months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date.
RA-10 Decide an urgent leaver and tell the service desk before the person is told
Your side IT service desk is told. Answers for it HR
Also involved: Line manager (does it), Head of Information Security (told)
The rule, JML-09A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within 60 minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after 90 days, once their data has been dealt with.
RA-15 Raise late leavers, residual access and orphaned accounts as access review findings
Your side Process owner is told. Answers for it Head of Information Security
Also involved: Campaign coordinator (does it)
The rule, JML-15Within 3 working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within 1 working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11).
RA-16 Request non-standard access for a non-employee, with the reason and an expiry no later than their end date
Your side IT service desk is told. Answers for it Sponsor
The rule, JML-04Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than 6 months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date.
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.