User Access Provisioning, Deprovisioning and Transfer

Introduction

This Directive from Concordia University outlines rules for managing user accounts and access to information systems. It aims to ensure these processes are consistent and effective, minimizing risks such as unauthorized access, service quality reduction, non-compliance, operational inefficiencies, data loss, resource waste, and cybersecurity threats.

Why is this required? The Chief Information Security Officer issued this Directive under the Information Security Policy (VPSS-33). VPSS-33 is adopted in accordance with the Directive sur la sécurité de l’information gouvernementale (section 7) which requires public bodies to adopt and implement a policy on the security of information.

What this means for you

Instructional and Information Technology Services (IITS) manages the Concordia identity and access management systems for both students and employee identities by assigning privileges based on a person’s role, that are used to manage authentication, authorization, and audits for all systems and applications utilizing centralized identity and access management. Faculties, departments, and units must leverage centralized identity access and management wherever possible when managing IT environments and applications.

In cases where the centralized Concordia identity and access management systems cannot be used and accounts or access are created or managed outside the centralized identity and access management systems, the unit’s IT application owners and administrators creating or modifying this access must define, document, and follow procedures for access approval, creation, maintenance, and removal based on IITS’ standardized templates and procedures.

For more detailed information about the roles and responsibilities of IITS, IT application owners and administrators, the general policies, metrics and controls, and identity and access management parameters read the full Directive. 

Feedback

The Chief Information Security Officer is responsible for implementing, reviewing, and approving this Directive and for conducting regular reviews to ensure compliance with internal and external requirements. If you have any feedback or questions about this Directive, please email ciso@concordia.ca

For accessibility-related questions or feedback related to IT security incidents, email iits-accessibility@concordia.ca.