Access provisioning is important for ensuring employees and contractors are granted the right level of access to systems and data they need to perform their roles—no more, no less. From a compliance standpoint, the key is to have a tracked and documented approval process in place. However, applying the ‘just enough’ principle to access provisioning can help avoid overcomplicating the process while maintaining security and compliance.
Key components of access provisioning
- Approval process for new hires: when a new employee or contractor joins the company, their access needs are often straightforward and tied to their role. The approval process should be simple and efficient:
- Role-based access: once HR approves a new role, the access needs associated with that role can be automatically or manually provisioned. This simplifies the process by defining what access is required based on the role itself, reducing the need for individual approvals.
- New hire checklist: tracking access provisioning as part of a new hire checklist can streamline the onboarding process. This checklist can be integrated into platforms like Vanta or Drata or managed separately, ensuring all necessary access is granted while other essential onboarding tasks are completed. This might include:
- Installation of Mobile Device Management (MDM)
- Completion of security awareness training
- Verification that background checks have been completed
- Tracking and documentation: whether through a dedicated platform or a simple checklist, it’s crucial to document the access provided. This not only supports compliance but also creates a clear record for auditing purposes.
- Ad hoc access approvals: throughout an employee’s tenure, there may be instances where additional access is required. Here, the ‘just enough’ principle is particularly valuable:
- Minimize formal tracking: while tracking access approvals is important, it doesn’t always need to be a formal, ticket-based system for every request. In many cases, a simple record—such as an email or a note in an internal system—can suffice to substantiate why access was granted and provide the paper trail to auditors, if needed.
- Focus on critical systems: prioritize formal approvals and tracking for systems that hold sensitive or critical data. By focusing on these key systems, you avoid the administrative burden of managing thousands of access requests. Least privileged access: always apply the concept of least privileged access. Only grant access if it’s truly necessary, and ensure there’s a substantial reason behind it.
- Trigger points for access removal: as part of the provisioning process, it’s important to consider when access should be revoked. Document any conditions or trigger points for removing access in the future, such as role changes, project completions or contract terminations. This ensures access is only maintained as long as it’s needed and sensitive systems remain secure.
Implementing 'just enough'
The minimum expectation to demonstrate access approvals is to have a new hire checklist or workflow ticket, that sets out the new hire's role and related access requirements. As a smaller company, other access provisioned by administrators can justify the administrator as the approver, so the approval is implicit in the granting of access. As a larger company, there’s often a separation between administrators and who is appropriate to approve, which then requires a workflow system to track approvals accordingly.
➡️ Doing less tip #1: steamlined approval process
Keep the approval process for new hires as streamlined as possible by leveraging role-based access and simple checklists. This reduces the burden on HR and IT teams while ensuring the necessary controls are in place.
➡️ Doing less tip #2: prioritize critical systems
Don’t overwhelm your team with the need to track every access request in detail. Focus on the most critical systems—those holding sensitive data or high-value information.
Better practices
Access control is an area that you can continually uplift with many better practices to consider. A few of the main ones include:
- Effectively map out role-based access to align all system access requirements to the defined roles of employees. This simplifies approvals and alignment of access to the concept of least privilege.
- Use an identity solution or compliance platform to centralize management of access oversight and review. This helps for access reviews, which in turn ensures provisioning and approval processes are working correctly or failures are identified promptly.
- Map out a list of all sensitive systems where access needs to be effectively controlled. This might also include any systems with licensing costs to manage those costs alongside information security risks. Assign system owners to each critical system that is responsible for approvals, removal of access, and periodic access reviews.
- Always apply the concept of least privilege. That includes minimizing the privileges granted to what’s needed; which might be read-only, or basic user access, rather than granting elevated privileges like admin roles. If the period of required access can be identified upfront, setting automated removal after that period or an access removal reminder at the point of initial granting, can ensure it’s removed effectively when no longer required.
In a nutshell
Access provisioning is a vital control for maintaining the security and integrity of your organization’s systems and data. By applying the ‘just enough’ principle, you can streamline the approval process, focus on critical systems, and simplify documentation, ensuring compliance without unnecessary complexity. This approach not only helps maintain security but also supports the efficiency of your IT and HR teams, allowing them to focus on what truly matters.