AUTH-8 Requesting and Approving access

What is AUTH-8 Requesting and Approving Access Control?

Requesting and approving access, or access request management, is the process of receiving, evaluating, and either approving or denying user requests to interact with organizational resources. Controlling the request and approval of access to critical systems can help reduce risk and improve efficiency. Managing access requests is best practice and mandatory.

It is best practice for this access request to have a legitimate reason (new hire, new role, job duties, new project, etc.) and to be approved by a legitimate employee (ideally a manager, the administrator of the system, or the program being requested).

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t personally used them.

Managing Access Authorization Tools

Integrify

Centrify

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version:

• N/A: no template recommendation

Control implementation

To implement this control,

1. Implement a formal and repeatable process to initiate access requests for new hires, including contractors, and for current employees.
2. Ensure the process includes an approval flow and approval is captured.

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

1. Provide an example of a completed access request ticket, checklist, or form that shows the initiation request.
2. Provide an example of a completed access request ticket, checklist, or form that shows the approval.

Evidence example

For the suggested action, an example is provided below:

1. Provide an example of a completed access request ticket, checklist, or form that shows the initiation request.
   The following screenshot shows an access request ticket and its approval.