IT/PPS 04.08 - Third-Party Applications Access Review
Third-Party Applications Access Review
IT/PPS No. 04.08
Issue No. 2
Effective Date: 5/15/2018
Next Review Date: 3/01/2020 (EY)
Sr. Reviewer: Associate Vice President, Technology Resources
This policy outlines the responsibilities of departments owning third-party enterprise computer applications, or modules thereof, to review and certify that access to those applications is appropriately granted and revoked.
It is important, in order to ensure confidentiality and integrity of university-owned data and processes, that only those people with a valid reason have access to the university’s enterprise computer systems.
Responsibility to ensure appropriate access rests with the department owning or utilizing the computer systems or modules in question. Technology Resources will maintain a document containing third-party computer application or module names and identified owners.
Each responsible application owner will receive notification annually to conduct a full review of all users currently holding access to the computer system or module they are responsible for and confirm the access is necessary and at the appropriate level for the job duties performed.
PROCEDURES FOR ACESS REVIEW
The procedures outlined provide details to ensure compliance with the security of Texas State University information resources (see UPPS No. 04.01.01, Security of Texas State Information Resources,).
Each department owning or utilizing an enterprise computer system or module must certify to the Division of Information Technology by July 1 every year that they have conducted a full review of user access, described in Section 01.04, and have corrected any outdated access permissions.
The application or module owner, or designee, responsible for the computer system named must sign the review certification.
Failure to provide the required certification will result in notification to the Information Security Office for follow up, as appropriate.
REVIEWERS OF THIS PPS
* Reviewers of this PPS include the following:
Position Date Associate Vice President, Technology Resources March 1 EY Chief Information Security Officer March 1 EY Vice President for Information Technology March 1 EY
This PPS has been reviewed by the following individuals in their official capacities and represents Texas State Information Technology policy and procedure from the date of this document until superseded.
Associate Vice President, Technology Resources; senior reviewer of this PPS
Vice President for Information Technology