CIP-4 - Identity Provisioning, Changes and Deprovisioning
Control of the complete identity lifecycle
Control Definition
The complete identity lifecycle must be automated under the Joiner-Mover-Leaver model, triggering access provisioning from the human resources system according to approved role templates, and ensuring each employee has the access they need in a timely manner. Access must be automatically revoked and reassigned when roles change, validating that this doesn't create segregation of duties conflicts, and all access must be deactivated immediately when employment ends. These processes must be audited periodically to ensure they work correctly.
Requirements
Requirement 1
We automate the complete identity lifecycle following the Joiner-Mover-Leaver model.
Requirement 2
We ensure new employees have all their access within a maximum time defined by the organization from their start date.
Requirement 3
We complete deprovisioning within a maximum time defined by the organization from HR's notification.
Requirement 4
We automatically trigger access provisioning from the HRIS at the time of hiring.
Requirement 5
We assign accounts, software licenses and access according to predefined, approved role templates.
Requirement 6
We record each access granted in the identity management system with traceability of the approval process.
Requirement 7
We automatically revoke the previous role's access and assign the new access when someone changes position or area.
Requirement 8
When employment ends, we deactivate the account, revoke all access and force-close active sessions.
Requirement 9
We validate the absence of segregation of duties conflicts on every role change.
Requirement 10
We audit the provisioning process on a scheduled basis.
Requirement 11
We audit the deprovisioning process on a scheduled basis.