Simple steps for giving, changing and removing user access when people start, change role or leave.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on user access, starters and leavers:

• Access Control, Passwords and User Authentication
• Leavers and Offboarding
• Induction of New Starters
• Information Security knowledge base

How to Download

These files are included in the alphaZ subscription. The guidance is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Need Help Implementing?

If you'd like hands-on help setting up your starter, role change and leaver access processes, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Managing Users Guidance

A general guidance document on managing user accounts, for managers and IT staff who set up and remove access, and for all users. It explains what a user is, why access is limited to what people need, and the processes for new starters, changes of responsibility and leavers.

Topics Covered

• What a user is - an account or unique login used to reach information systems, usually assigned to a person for their job
• Managing user accounts - giving people the access they need, removing what they do not, and the situations that trigger a change
• New starters - creating a unique user name and password, and reviewing, approving and assigning only the access the role needs
• Change of responsibility - reviewing access after a promotion or restructure, such as removing access to personnel records when someone moves out of HR
• When someone leaves - removing access at close of business on the last day, or at once on dismissal or leaving without notice, and recovering equipment

Who Is It For?

Managers who request or approve access, the people who set up and close user accounts, and all employees who hold a user account.

Included in the ISO 27001 and ISO 22301 Toolkits

This guidance is supplied with the TT-8-08 Managing Users training talk, which is part of the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.

Using the Guidance

Issue it to managers and IT staff who handle starters and leavers, go through it with the matching training talk, and keep it as a reference alongside your induction and leaving processes. Record who has received it, for example on the training matrix.

Closing Accounts When People Leave

The guidance is firm on leavers. Access to computer systems and data is removed at the close of business on the last working day, or straight away if someone is dismissed or leaves without notice, and a process closes every account they held and makes sure all equipment that can access or store information is returned.

Adapting the Guidance

Edit the guidance to match your own arrangements - who creates accounts and approves access, how role changes are passed on, and your leaving process for closing accounts and returning equipment.

Related Documents

Other documents that work alongside this guidance:

• PP-8-04 Access Control Policy Procedure
• P-89 User Access Management Policy
• F-Q4 Staff Induction Record
• F-Q20 Staff Leaving Checklist
• GG-8-04 Access Control and User Authentication

Reviewing Access When Roles Change

A promotion or restructure can change what someone needs to see. The guidance gives the example of a person moving out of HR, who should no longer have access to personnel records, and expects a process that triggers the review.