1. Document Control

• Document Title: User Access Provisioning and Deprovisioning Procedure

• Document Identifier: PRC-IT-001

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <IT Operations Manager>

• Approved By: <Chief Information Security Officer>

2. Purpose

The purpose of this procedure is to define the steps for granting, modifying, and revoking user access to ’s information systems, data, and applications. Consistent implementation of this procedure supports role-based access control (RBAC), least privilege principles, and lifecycle management of user identities.

This document is designed to satisfy SOC 2 Trust Services Criteria CC6.1 and CC6.2, which require control over logical access to systems and data, as well as ISO/IEC 27001:2022 Controls A.5.15 (Access control policy), A.5.16 (User access management), A.5.17 (User registration and deregistration), and A.5.18 (Privilege management).

3. Scope

This procedure applies to:

• All employees, contractors, interns, and third parties with access to ’s systems

• All systems, applications, and services that require authentication or authorization

• All access types including standard user, privileged, service, and API accounts

This procedure governs both new access provisioning and access removal during offboarding or internal role changes.

4. Procedure Overview

4.1 Access Provisioning

1. Access Request Initiation

   • Manager or hiring supervisor submits an access request through the IT ticketing system or HRIS integration.

   • Request must include: name, role, department, required systems, justification, and start date.

2. Approval Workflow

   • Requests must be approved by both the hiring manager and the system/data owner.

   • Elevated access (admin/root) requires additional approval from IT Security.

3. Account Creation and Role Assignment

   • IT or IAM administrator creates the account using standard naming conventions.

   • Role-based access templates are used for consistency.

   • MFA is enforced for all accounts accessing sensitive or production systems.

4. Documentation

   • All access requests and approvals are documented and retained for a minimum of 2 years.

4.2 Access Modification

1. Role or Department Changes

   • HR or manager notifies IT of any changes impacting access needs.

   • A new access request is submitted with updated requirements.

   • Old permissions are reviewed and revoked as needed before new ones are granted.

2. Periodic Access Review

   • Quarterly access reviews are performed by system owners.

   • Any discrepancies are remediated and documented in the audit log.

4.3 Access Deprovisioning

1. Termination Notification

   • HR triggers the offboarding workflow upon resignation, termination, or contract end.

   • Immediate terminations are flagged as urgent for same-day processing.

2. Account Deactivation

   • IT disables user accounts within 24 hours of termination notice.

   • Shared credentials and service accounts are rotated if applicable.

   • Device access, VPN, email, and SaaS tools are all covered in the deprovisioning checklist.

3. Data Retention/Transfer

   • User-owned data is reassigned to the manager or designated backup.

   • Data stored in personal drives or inboxes is archived or deleted per data retention policy.

5. Roles and Responsibilities

6. Safeguards and Controls

7. Compliance and Exceptions

All provisioning and deprovisioning actions are subject to internal audit. Exceptions to this procedure must be approved by the CISO, documented with a risk assessment and compensating controls, and reviewed biannually.

8. Related Policies/Documents

• POL-ALL-003: Access Control Policy

• POL-HR-001: Employee Onboarding and Offboarding Policy

• POL-ALL-015: Confidentiality Policy

• POL-HR-002: Security Awareness and Training Policy

• SOC 2 Trust Criteria: CC6.1, CC6.2

• ISO/IEC 27001:2022 Controls: A.5.15–A.5.18

9. Review and Maintenance

This procedure shall be reviewed annually by the IT Operations Manager and CISO or upon implementation of a new identity and access management (IAM) solution. All procedural changes must be version-controlled, approved, and communicated to stakeholders.