This talk sets out how access is handled for starters, role changes and leavers, step by step. The guidance explains the records that show each change was approved and made.
This training talk is supplied in fully editable MS Word format, prepared using the F-Q7 Training Talk Attendance Record form template. All text is in Calibri font for improved readability.
The following document labelling is included in the footer:
- Talk number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested training talks. No junk, jargon or unnecessary content. Simple and usable training material
developed over 25 years through practical use in the real world.
Further guidance on managing user access:
Download this training talk with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. The training talk is also included in the ISO 27001 and ISO 22301 toolkits, including the integrated toolkits that combine them.
If you'd like hands-on help preparing your information security risk assessment and treatment plan, and the user access records that support it, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
Managing Users Training Talk
A training talk on managing users for managers, HR and IT staff - unique accounts for new starters, approved access, reviewing access on a change of role, and removing access and recovering equipment when someone leaves. The download gives you a one-page attendance record with the talk description already filled in, plus the full guidance document to run the talk from.
Two Files in One Download
- TT-8-08 Managing Users - the attendance record, with the topic and talk description ready to use and a signature line for each attendee
- GG-8-08 Managing Users - the guidance document the talk is based on, to prepare from and to issue to staff afterwards
Talk Description
- What a user account is
- Why access is limited to what each person needs
- New starters - unique accounts and approved access
- Changes of role - reviewing and updating access rights
- Leavers - suspending access at the end of the last working day
- Returning equipment that can access or store information
Running the Talk
Read through the guidance beforehand, talk the points through with the team, then have everyone sign the record. Keep the signed record as evidence that the briefing took place and who received it.
Why Leavers Lose Access on Their Last Day
An account left open after someone leaves can still be used, by the leaver or by anyone who knows the password. The talk covers suspending access at the end of the last working day and getting back any equipment that can access or store information, so nothing is left behind.
Adapting the Talk
Both files are fully editable, so add how access requests are approved, who sets up and suspends accounts and how equipment is returned and recorded when someone leaves. Update the talk description if you cover extra points.
Keeping the Training Record
File the signed record with your training records, or log the talk against each attendee in a training matrix, so you can show who has been briefed and when.
Who Is It For?
Line managers, HR and IT staff, and anyone who requests, approves or sets up user access. It works as a refresher for those roles and whenever the starter and leaver process changes.
Included in the ISO 27001 and ISO 22301 Toolkits
This training talk is part of the ISO 27001 and ISO 22301 toolkits, and is included in the integrated toolkits that combine them.
Delivering Talks Regularly
Short, regular talks keep information security in front of people. Run this one alongside the other information security training talks to build awareness one topic at a time.
Related Training Talks
Other training talks that work alongside this one:
Would you rather we prepared it for you?
A day of remote support can build your information security risk register around your actual systems - your risks scored with a named owner, the treatment decided for each one and the Annex A controls that apply - so the controls your staff are briefed on are the ones you have chosen.
Information Security Risk and Treatment Plan