Printed on: 05/24/2018. Please go to http://policy.umn.edu for the most current version of the Policy or related document.

ADMINISTRATIVE PROCEDURE

Managing Access to University Information

Request, Approve and Provide Access to University Information

The following steps should be taken when an individual requires access to University information:

Employee
  1. Employee consults with supervisor to identify specific systems on which access (based on business need) is required.
  2. Employee completes access request, filling out any required documentation, and submits to supervisor.
Supervisor
  1. Consults with employee regarding specific systems on which access (based on business need) is required.
    1. Identifies and selects appropriate access request process for selected systems (e.g., Access Request Form for enterprise Human Resources, Finance and Student systems).
    2. If not done by employee, completes access request process, filling out any required documentation.
  2. Reviews and approves access request.
  3. Submits access request to data owner or their delegate.
Data Owner or Delegate
  1. Reviews and authorizes/denies access request.
    1. Communicates authorization decision to requestor.
  2. Forwards authorized access request to appropriate staff (e.g., application data custodian, technical staff) for provisioning.

Terminate Access to University Information

The following steps should be taken when an individual terminates employment at the University, takes a non-working leave of absence or has another change that requires access to University information be terminated:

Employee
  1. Employee consults with supervisor to review systems on which employee currently has access.
    1. Identifies systems on which access is no longer required.
Supervisor
  1. Consults with employee to review systems on which employee currently has access.
    1. Identifies systems on which employee no longer requires access based on business need.
    2. Identifies and selects appropriate access termination process for selected systems.
  2. Completes access termination request process, filling out any required documentation.
  3. Submits termination request to appropriate staff (e.g., application data custodians, technical staff) for de-provisioning.

Modify Access to University Information

The following steps should be taken when an individual transfers to another unit, has a change in job status or has another change that requires access to University information be modified:

Employee
  1. Employee consults with supervisor to review and identify:
    1. Specific systems on which access (based on business need) is required.
    2. Systems on which access is no longer required.
  2. Employee completes access request, filling out any required documentation and submits to supervisor.
Supervisor(s) (current and new)
  1. Consults with employee to review and identify:
    1. Specific systems on which (based on business need) access is needed.
      1. Identifies and selects appropriate access request process for selected systems (e.g., Access Request Form for enterprise Human Resources, Finance and Student systems).
      2. If not done by employee, completes access request process, filling out any required documentation.
    2. Systems on which access is no longer required.
      1. Identifies and selects appropriate access termination process for selected systems.
      2. Completes access termination request process, filling out any required documentation.
  2. Reviews and approves access and termination requests.
    1. Submits access request to data owner or their delegate.
    2. Submits termination request to appropriate staff (e.g., application data custodians, technical staff) for de-provisioning.
Data Owner or Delegate
  1. Reviews and authorizes/denies access request.
    1. Communicates authorization decision to requestor.
  2. Forwards authorized access request to appropriate staff (e.g., application data custodian, technical staff) for provisioning.

Document Feedback