The purpose of this standard is to establish the university’s obligation to ensure that user access is based upon authorization and that unauthorized access to systems and services is prevented.
It is the responsibility of all system owners to determine appropriate controls, rules, access rights and restrictions for their information or information systems. They must assure that access is provided only to authorized users and that unauthorized access is prevented.
Direct any general questions about this standard to your unit’s Information Security Liaison. If you have specific questions, please contact ITS Information Security Compliance at ISCompliancefirstname.lastname@example.org.
To assure only authorized access to their systems, owners should implement the following:
- A process for assigning, enabling, and revoking a user account
- A process for providing and revoking privileges associated with a user account
- A process for the controlled allocation and use of privileged access rights
- A process for managing the use of passwords, and, if implemented, managing encryption/cryptographic keys, and tokens
- A process for the review of user access rights at regular intervals
- A process for the removal and adjustment of access rights upon change of role, employment, contract, agreement or other status.
ISO/IEC 27002 was adopted by The University of North Carolina at Charlotte in 2012. All standards and guidelines are based on this code of practice for Information Security Management.
Initially approved by the Information Assurance Committee 4/2/15