How do we build role-based access profiles without a role-mining project?

Start

You need standard access for the common jobs

A role profile is approved once and granted many times: joiners and movers receive it without further approval. That only works if every profile is right, so a profile never holds a conflict or privileged access. The method needs no role-mining tool, only the HR record's job roles, each system's own user list and the system owners' judgement.

• Then: Rank job roles by headcount from the HR record

Step

Rank job roles by headcount from the HR record

List the job roles in the HR record with the number of people in each, largest first, and keep the dated extract. In the pack's example seven role profiles covered 701 of about 900 staff, which the pack calls a good first year.

• Then: Is this one of the roles that hold most staff?

Decision

Is this one of the roles that hold most staff?

Start with the largest roles and work down. Where to stop is your judgement: the pack's advice for a small organisation is to begin with the three or four roles that hold most staff. A role of only a few people may not be worth a profile yet.

• Yes: Extract who holds what in each system, with last sign-in
• No: a role of a few people: Use the base profile and non-standard access for now

Outcome

Use the base profile and non-standard access for now

People in smaller roles receive the base profile, and anything more the job needs as non-standard access with an approval and an expiry. Revisit the role at the annual profile review: non-standard access that most of a role has held for a year is a candidate for a profile.

Step

Extract who holds what in each system, with last sign-in

Take each system's own user list for the people in the role, with the rights each holds and when they last signed in. Keep each extract with its date: it is the evidence the profile was built from what people actually hold.

• Then: Keep rights most of the role hold and recently used

Step

Keep rights most of the role hold and recently used

Keep a right only if at least 80% of the people in the role hold it and have used it in the last 90 days, by the pack's defaults. A right held by fewer, or not used recently, stays out of the profile. The workbook's inclusion test does the arithmetic for one right at a time.

• Then: Each system owner strikes out what the job does not need

Step

Each system owner strikes out what the job does not need

Ask the owner of each system to strike out anything the role does not need for the job. Needed means the job cannot be done without the right, at that level, now: a clerk who enters invoices needs the entry role, not a supervisor role that also approves them. Keep the owner's marked-up list.

• Then: Does the draft include any privileged right?

Decision

Does the draft include any privileged right?

A right is privileged if it gives administrator access: administrator groups, super-user roles, an application's admin console. No profile ever holds one, whatever share of the role holds it today. If you cannot tell whether a right is administrative, ask the system owner and treat it as privileged until they answer.

• Yes, or not sure: Take it out; it goes to the privileged access process
• No: Does the draft hold both duties of a conflict?

Step

Take it out; it goes to the privileged access process

Note each privileged right you leave out and where it is managed instead. In the pack's example the directory administrator groups and the online ordering admin console appear in no profile and follow the privileged access standard, with separate accounts and their own approvals.

• Then: Does the draft hold both duties of a conflict?

Decision

Does the draft hold both duties of a conflict?

Check the draft against each conflict in the segregation-of-duties conflict matrix, written as the two rights in the system's own words. A profile never contains both duties of a conflict, because every joiner and mover would then receive the conflict with no further approval. If the matrix has not been mapped to your systems' rights yet, do that first.

• Yes, or not known: Split the duties into separate profiles
• No: Name the profile owner and send each right to its system owner

Step

Split the duties into separate profiles

Put the two duties in two profiles held by different people. In the pack's example the accounts payable clerk holds supplier bank details and the payments officer holds payment approval, so no profile holds both. A profile is never approved with a conflict inside it, even where one person will later need an exception.

• Then: Does the draft hold both duties of a conflict? (back to an earlier step)

Step

Name the profile owner and send each right to its system owner

The profile owner is normally the head of the department that holds the role. The owner of every system in the profile approves the rights in their system, with the date. The person who builds the groups that carry the profile does not approve its content.

• Then: Has every system owner approved the rights in their system?

Decision

Has every system owner approved the rights in their system?

A role profile is approved by the owner of every system in it, and that one approval covers every joiner and mover who receives it. A right whose system owner has not approved it is not yet part of the profile.

• No, not yet: Do not use the profile until every approval is in
• Yes: Do people in the role hold rights outside the profile?

Outcome

Do not use the profile until every approval is in

Clear every check that does not show the right as ready for the profile before the profile is used. Until then, joiners in the role receive the base profile and request what else they need as non-standard access.

Decision

Do people in the role hold rights outside the profile?

Compare what each person in the role holds with the approved profile. Rights the profile leaves out, because few people hold them or they were not needed, are still on people's accounts until someone acts.

• Yes: Approve each extra right with an expiry, or remove it
• No: Use it for joiners and movers; review it every 12 months

Step

Approve each extra right with an expiry, or remove it

Everything else a person in the role holds is non-standard: it is approved by the line manager and the system owner with an expiry no more than 6 months ahead by the pack's default, or it is removed. Nothing outside a profile stays without an end date.

• Then: Use it for joiners and movers; review it every 12 months

Outcome

Use it for joiners and movers; review it every 12 months

Joiners and movers now receive the profile without further approval. Review each profile every 12 months by the pack's default, and after a reorganisation or a new core system, recording what changed and who approved it. Non-standard access that most of the role has held for a year is a candidate to join the profile at that review.