2 Review of CCIS accounts with Feb. 1, 2016 Disable accounts that February 1, 2016 Accounts were disabled Administrative and Support no longer require this level of access 1, 2016 IT Manager privileges implemented mandatory Ensure user access user access form for forms are completed Help Desk; a related for all account communication was creation, role change sent to all management or disable/ staff and Help Desk termination June 22, Develop to manage January 2017 CCIS access matrix 2016 and control all developed and vendor and service implemented for vendor access accounts. and service accounts 2 Ensure managers receive list Mar. 2, No recommendations No recommendations No recommendations of employees’ access/roles and 2016 confirm/update as necessary Sept. 1, 2016 1 Audit access to CCIS data Aug. 15, Terminate two Aug. 15, 2016 Accounts terminated base to ensure only staff with 2016 accounts for former CCIS responsibilities are employees Accounts were accessing it modified Modify two accounts for staff who had changed roles 1 Physical Security Log Audit Aug. 11, No recommendations No recommendations No recommendations 2016
2 Review of CCIS accounts with Administrative and Support privileges Feb. 1, 2016 Disable accounts that no longer require this level of access Ensure user access forms are completed for all account creation, role change or disable/ termination February 1, 2016 1, 2016 Accounts were disabled IT Manager implemented mandatory user access form for Help Desk; a related communication was sent to all management staff and Help Desk June 22, 2016 Develop to manage and control all vendor and service access accounts. January 2017 CCIS access matrix developed and implemented for vendor and service accounts 2 Ensure managers receive list of employees’ access/roles and confirm/update as necessary Mar. 2, 2016 Sept. 1, 2016 No recommendations No recommendations No recommendations 1 Audit access to CCIS data base to ensure only staff with CCIS responsibilities are accessing it Aug. 15, 2016 Terminate two accounts for former employees Modify two accounts for staff who had changed roles Aug. 15, 2016 Accounts terminated Accounts were modified 1 Physical Security Log Audit Aug. 11, 2016 No recommendations No recommendations No recommendations
2017-hhs-criticall-review.docx