Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we set up a new starter's access before their first day?

7 decision pointsThe pack behind this answer: Joiner-Mover-Leaver & Access Provisioning

Add to board memo

The short answer

Recommendation
Create a starter's accounts only from HR's record or, for a non-employee, the sponsor register. Give them the approved role profile, check the resulting access for conflicts, create the accounts disabled shortly before the start and enable them on the start date.
Reasoning
Most access that should not exist was created on a manager's email and never tied to a record that ends. Tying every account to the HR record or the sponsor register lets you find it again, and a non-employee's end date ends their access even when nobody tells HR. Approved role profiles need no further approval, so only access outside them is requested. Checking the resulting access before any account exists stops a starter holding both sides of a conflict.
Considerations
  • The 5 working days of notice and creation, the 12-month limit on a non-employee's end date and the 6-month limit on non-standard access are the pack's defaults. Your own standard may set others.
  • A senior requester changes nothing. Refuse an account with no HR or sponsor record. If HR records the joiner late, create the accounts that day, enable them no earlier than the start date and report the late notice to the process owner.
  • A conflict that cannot be separated goes to the exception process. At Critical it is approved by the board, or a board risk committee it has delegated to; the management board in a two-tier structure; or executive management where there is no board.
  • Privileged access is never in a role profile or on the access request form. It follows the privileged access standard, with its own accounts and approvers (JML-16).

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA new starter's first day is comingDecisionIs the starter an employee?DecisionHas HR recorded the start date, job and line manager?DecisionDid HR record it at least 5 working days before the start?StepWork from the day the record arrives; report the late noticeDecisionIs the starter in the sponsor register with an end date?OutcomeCreate nothing until HR or the sponsor records the starterStepPlan every account to expire at the end dateStepThe manager or sponsor confirms the role profileDecisionDoes the job need anything outside the profile?StepRequest it on the access request form, with an expiryDecisionDoes the resulting access hold both sides of a conflict?OutcomeStop and ask the profile owner; grant nothing yetDecisionDoes the job need administrator or other privileged rights?StepRequest it separately through the privileged access procedureStepCreate the accounts disabled, within 5 working days of the startStepEnable on the start date, and give the first sign-in safelyOutcomeLog every grant the same day; confirm non-standard ones in the system

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 18 steps.

  1. Start

    A new starter's first day is coming

    Most access that should not exist was created on a manager's email and never tied to a record that ends. The pack therefore creates every account from an event in the HR record or the sponsor register, and from nothing else, however senior the person asking. A late start record is the commonest reason a joiner borrows a colleague's account on day one.

    In the pack

  2. Decision

    Is the starter an employee?

    An employee's source is the HR record. Anyone given an account who is not on the payroll, such as a contractor, an agency worker, a consultant or a supplier's staff, is a non-employee, and their source is the sponsor register. The two routes differ in who records the starter and in the end date.

    In the pack

  3. Decision

    Has HR recorded the start date, job and line manager?

    The HR record is the request. Missing or wrong details are corrected at the source, never on the ticket. If a manager asks for an account and HR has not recorded the person, refuse and ask the manager to have HR record them.

    In the pack

  4. Decision

    Did HR record it at least 5 working days before the start?

    HR records a joiner at least 5 working days before the start date by the pack's default, so the accounts can be ready on day one. Agree with HR how a new start reaches the service desk: an automatic feed is best, a daily report acceptable, an email from HR the minimum.

    In the pack

  5. Step

    Work from the day the record arrives; report the late notice

    Create the accounts the day the record arrives and enable them on the start date at the earliest. Never enable an account before it is recorded, and never lend a colleague's account to fill the gap. Report the late notice to the process owner, who owns the joiner process.

    In the pack

  6. Decision

    Is the starter in the sponsor register with an end date?

    The sponsor, normally the line manager of the team the person works for, records who they are, why they are here and the end date, before any account is created. The end date is no more than 12 months after the start by the pack's default. Only the sponsor can extend it later.

    In the pack

  7. Outcome

    Create nothing until HR or the sponsor records the starter

    No account is created on a manager's request alone, and no account exists without a record in the HR record or the sponsor register. Ask the manager to have HR or the sponsor record the person, then start again from the record. A senior requester does not change this.

    In the pack

  8. Step

    Plan every account to expire at the end date

    When the accounts are created, set each one to expire at the end of the end date: the directory account, and each local account whose system can expire accounts. Where a system cannot, put the end date on that system's line of the leaver checklist. This is what ends a contractor's access when nobody tells HR.

    In the pack

    See also

  9. Step

    The manager or sponsor confirms the role profile

    The base profile and the job's role profile need no further approval: they were approved in advance by the profile owner and each system owner. A job with no profile gets the base profile only. Copying a colleague's access ("same as Sam") is never the way to set up a starter.

    In the pack

  10. Decision

    Does the job need anything outside the profile?

    Any right that is not in the base or role profile is non-standard. It needs its own request, whoever the starter is. Ask now, so the request can be approved and checked before the start date.

    In the pack

  11. Step

    Request it on the access request form, with an expiry

    The line manager or sponsor asks for the right in the system's own words, with the task it is needed for. The line manager or sponsor and the owner of the system or data both approve it, and its expiry is no more than 6 months ahead by the pack's default, never after a non-employee's end date. In the pack's example a new sales account manager's extra report was requested this way before the start.

    In the pack

    See also

  12. Decision

    Does the resulting access hold both sides of a conflict?

    Before any account is created, the service desk lists the starter's resulting access (the base profile, the role profile and any non-standard rights) and checks it against the conflict matrix. A profile never holds a conflict, so a conflict here means the profile or the request is wrong. If the check cannot be run, do not create the accounts.

    In the pack

  13. Outcome

    Stop and ask the profile owner; grant nothing yet

    Tell the line manager and the system owner. A profile never holds a conflict, so the profile or the request is wrong: separate the conflict by correcting the profile or refusing the extra request. Only a conflict that cannot be separated goes to the exception process, and nothing is granted until it is approved there.

    In the pack

    See also

  14. Decision

    Does the job need administrator or other privileged rights?

    Privileged, emergency and service account access is never part of a role profile and never on the access request form. It follows the privileged access standard, with its own accounts, approvers and time limits. A starter's everyday account never carries it.

    In the pack

  15. Step

    Request it separately through the privileged access procedure

    Privileged access is approved by the approvers the privileged access standard names for its tier, and nobody approves their own. Administration is done only from a separate administrator account, named for one person and one tier, and the everyday account holds no administrator rights anywhere. Set up the everyday account here; the administrator account follows its own route.

    In the pack

    See also

  16. Step

    Create the accounts disabled, within 5 working days of the start

    The service desk creates the directory account with the base and role profile groups, and asks the named administrator of each system with local accounts to create those. Every account is created disabled, no earlier than 5 working days before the start date by the pack's default. The starter cannot sign in to anything yet.

    In the pack

  17. Step

    Enable on the start date, and give the first sign-in safely

    Enable the accounts on the start date, never before: enabling early "to save time on day one" is ruled out. Give the first password or sign-in set-up only to the starter, in person or through a channel checked against the HR record. The starter enrols their own second factor.

    In the pack

    See also

  18. Outcome

    Log every grant the same day; confirm non-standard ones in the system

    Record each grant in the provisioning log with the request reference, the profile or approved request as the approval, who made it and when. For each non-standard grant, also confirm in the system itself that the right took effect, as the pack requires, rather than relying on the ticket. The month-end reconciliation then matches every account to a person in the HR record or the sponsor register.

    In the pack

Practical checklist

  1. Confirm HR has recorded the start date, job, department and line manager, or that the sponsor has recorded a non-employee with a reason and an end date.
  2. Have the line manager or sponsor confirm the role profile. Request anything outside it on the access request form, with two approvals and an expiry.
  3. List the starter's resulting access and check it against the conflict matrix before any account is created. Stop if there is a conflict or the check cannot be run.
  4. Request any administrator rights separately through the privileged access procedure.
  5. Create the accounts disabled, local accounts included, no earlier than 5 working days before the start. Set a non-employee's accounts to expire at the end date.
  6. Enable the accounts on the start date. Give the first sign-in only to the starter, and have them enrol their own second factor.
  7. Log every grant the same day with the request reference and the approval. Confirm each non-standard grant in the system itself.

Evidence to have ready

  • For each joiner, the date HR recorded them, the date the accounts were created and the date they were enabled.
  • For each non-employee, the sponsor and end date recorded before the account was created, and the account's expiry set to match.
  • The approved request for any non-standard access, with both approvals and its expiry.
  • The segregation-of-duties check for each grant, with the matrix version used.
  • The provisioning log entry for every grant, and the monthly reconciliation matching every account to a person in the HR record or the sponsor register.

Assumptions

  • HR records each employee joiner with the start date, job, department and line manager, and someone keeps a sponsor register for non-employees.
  • Approved role profiles exist for your common jobs. If they do not, start with “How do we build role-based access profiles without a role-mining project?”; until then a starter gets the base profile and non-standard access.
  • The 5-working-day notice and creation window and the 12-month limit on a non-employee's end date are the CISO Times pack's defaults. Your own standard may set others.

Not covered here