Quezon City University

Process: IT Access Management

Activity 3

# Process/ Subprocess Risk

Users are granted access

rights on the basis of an
approved request. and
limited only to access
required to carryout their job
responsibilities.

Unique user ID is assigned

to each user. No group IDs
exist and shared by multiple
users.

A.New hires & transfers

Changes to users’ access

should be approved and
their role re-evaluated to
prevent “role creep” which is
caused by incremental
additions to access
overtime, causing
segregation of duties risks.

Access rights should be

promptly disabled and/or
removed once users leave
the company.

B.Terminations and
resignations
If there is no or ineffective
periodic review, extended
testing of terminations and
resignations is performed
 Existing controls Frequency Objectives

Data Ownership on the to prevent unauthorized

classification of data access to data and
elements and the allocation unauthorized use of system
of responsibility for ensuring functions and program
confidentiality. Assigning
responsibility for protecting
data to a particular
employee, accountability is
established

Privacy impact analysis is to establish a right to trust

an instrument for assessing
the potential impacts on
privacy of a process,
information system,
program, software module,
device or other initiative
which processes personal
information and in
consultation with
stakeholders, for taking
actions as necessary to
treat privacy risk.
that others will appropriately
and legitimately use, store,
share, and dispose of the
associated personal and
sensitive information within
the context, and according
to the purpose for which the
data have been stored and
derived

data are identified and

authorized in writing

Written termination policies provide adequate protection

are established and provide for the organization's assets
clear steps for employment and data
separation. Addressing
voluntary and involuntary
separation

Audit Procedures
(Test of Design)
use the information
regarding data ownership to
determine if proper
ownership has been
assigned and whether the
data owner is aware of the
assignement.
Audit Procedures
(Test of Operating
Effectiveness)
review a sample of the job
description to ensure that
responsibilities and duties
are consistent with the
security policy.

Review management's check whether personnel

Privacy Policy to ascertain sensitive are correctly
whether it takes into managed and verify if the
consideration the correct security measures
requirement of privacy laws are adopted.
and regulations.

organization have a clear asses if the necesssary item

definition and
documentation procedure
for teminating employee to
the compay
have been refunded such
as devices, item keys, ID
cards and Badges to
prevent easy physical
access