AW-15 · IT Access, Accounts and Service Requests

1. Purpose and scope

Purpose. To ensure that every person working for or with IoL has the system access their role needs on their first day and no more, that access is reviewed by the person accountable for the data rather than by the person who keeps the list, that access ends on the day the person leaves, and that IT requests, faults and security concerns reach HQ IT through one route that leaves a record and carries HQ IT security clearance for anything non-standard.

Scope statement. This procedure manages IoL's part of IT access and IT services from a request or a joiner, role change or leaver notification to provisioning, acceptance, review and removal, together with software, hardware and new IT service requests, faults, incidents and the systems IoL administers.

Applies to. Staff, adjuncts, clinical educators, visiting faculty, contractors and student assistants holding access to any system on IoL's behalf; the learning management, assessment, survey and student records systems, shared drives, the AW-03 repository, the simulation and AV systems, the AW-22 CRM and any system IoL administers [SDO to confirm the list]; requests for IT access, software, IT hardware and new IT services, with or without cost.

Does not apply to. Learner accounts, provisioned on enrolment through WF-07; the execution procedures of HQ IT; institutional information security policy and infrastructure; facilities, space, room booking and civil works requests, which enter through the same form and triage but are managed under AW-14; data protection decisions, which are AW-16's and which this procedure executes.

Rules that hold throughout. IT requests enter through the Workplace Request Form and the SDO Workplace Officer's triage, the same front door as facilities requests under AW-14. Standard IT services on the Annex A list of IOL-OPS-009 (password reset and account unlock; installation of standard software from the HQ catalogue; access to existing shared drives or systems with line manager confirmation) go straight to the HQ IT service desk without Chair endorsement. Everything else needs Chair endorsement, SDO assessment and HQ IT security clearance before provisioning. Access is least-privilege. No joiner receives access without a request traceable to AW-07 or AW-08, and no leaver keeps access past the last working day.

2. Trigger, boundary and interfaces

3. Roles and accountability

Process owner. Head of Administration and Operations (HAO). Custodian. Administration Affairs (SDO), whose Workplace Officer triages and assesses requests, coordinates with HQ IT, keeps the IoL access register and closes requests. Where IoL runs a system itself, the IoL system administrator acts within the SDO Workplace Officer's lane [HAO to confirm who holds the role].

The Dean holds the highest IoL authority in this procedure; the Dean's own requests are approved by the Dean's superior, named in AW-05.

[CONTROL] Segregation. The person who approves access does not provision it: the data owner and the value-tier approver decide, HQ IT provisions. The SDO Workplace Officer keeps the access register and does not sign the quarterly review; the data owner signs it. The system administrator does not approve their own privileged access and holds no approval authority in the routing they configure (AW-05). Write access to the published area of the controlled document repository is limited to the Document Controller under AW-03.

[CONTROL] Delegation tiers. For a request with cost, tier 1: SDO Head of Finance within the internal limit set by the HAO. Tier 2: HAO up to the HAO limit. Tier 3: Dean up to the Dean's authority under the DOA Manual. Above the Dean's authority the request goes through HQ for Level 3 approval. The three values are stated in AW-05 [HAO to state; not yet stated in any document].

4. Procedure

1. Maintain the access matrix and system routing. For each system and dataset the role-based access matrix, a controlled register under AW-03, names the data owner, the standard access for each IoL role (none, read, write, administer) and whether the data is restricted under AW-16. Administrator rights on systems IoL administers are held by named individuals on a separate account, approved by the HAO and listed in the privileged access register with an expiry not exceeding 12 months; shared administrator accounts are not used. The system administrator implements the approval routing the HAO specifies from the AW-05 register and records every change to a system IoL runs, with test and rollback, for the HAO's approval; no change touches assessment delivery during an assessment period. [CONTROL] Access outside the standard for a role requires the data owner's written approval with a reason and an expiry date; no routing change is made without an approved AW-05 register change. Next: step 2.

2. Submit the request through the front door. The requester submits the Workplace Request Form, shared with AW-14, stating the category (access, software, hardware or new IT service), the person or system concerned, the scope, the required date and, where cost applies, the budget entity, University or DAHC, and the sub-account. For a joiner or a role change the HR coordinator raises the request under AW-07 or AW-08 at the role's standard profile, at least 5 working days before the start date. A leaver notification goes directly to step 11. [CONTROL] No access is provisioned without a request traceable to AW-07, AW-08 or a submitted form; a request from the joiner themselves is not sufficient. Next: step 3.

3. Triage the request. Within 1 working day the SDO Workplace Officer records whether the request is a standard service on the Annex A list, standard access at the role's profile with the line manager's confirmation, or non-standard: access outside the role's profile or to a restricted dataset, software outside the HQ catalogue, IT hardware, a new IT service, an integration or a privileged account. Decision point. Standard: step 8. Non-standard: step 4. Not an IT request: managed under AW-14 from the same triage.

4. Endorse a non-standard request. The Department Chair reviews the business need. Decision point. Endorsed: step 5. Returned with comments: step 2. Declined: the request is closed and the requester informed. Timeout. A returned request not resubmitted within 10 working days is closed.

5. Assess the request and approve dataset access. The SDO Workplace Officer assesses scope, feasibility, estimated cost, budget entity and availability, consulting the SDO Head of Finance and HQ IT, checks software against the AW-13 licence register and identifies hardware for AW-13. Where the request touches a dataset IoL controls, the data owner approves, reduces or refuses the access in writing; access to a restricted dataset waits for the AW-16 induction record, and a free tool that processes personal data needs AW-16 review first. [CONTROL] No non-standard access to an IoL dataset proceeds without the data owner's written approval. Decision point. Assessed and, where relevant, approved: step 6. Refused: the request is closed and the requester and Chair informed.

6. HQ IT security and compliance review. HQ IT reviews the request for security, data protection, licensing and integration requirements, with the SDO Workplace Officer consulted, and issues or withholds the security clearance. [CONTROL] Non-standard IT services are not provisioned without HQ IT clearance. Decision point. Cleared: step 7. Not cleared: returned to the requester for revision, step 2. Timeout. Not resubmitted within 10 working days: the request is closed.

7. Approve cost within delegation. The SDO Workplace Officer confirms whether the cleared request involves cost to IoL. Where it does, the approver for the value tier (section 3) approves, returns or rejects it and the Chair is informed; the purchase is processed under AW-10 and IT hardware is registered under AW-13 before use. [CONTROL] The approval matches the AW-05 tier for the total value; no splitting. Decision point. No cost: step 8. Cost approved: purchase under AW-10, then step 8 on delivery. Returned: step 5. Rejected: the request is closed and the requester and Chair informed.

8. Provision or deliver the service. HQ IT provisions the access, installs the software or delivers the service under its own procedures; the SDO Workplace Officer coordinates the schedule with the requester. A joiner's standard access is active on the first working day. [CONTROL] Access is granted at the level approved and no more, with any expiry date recorded; a privileged account is provisioned only against the privileged access register. Next: step 9.

9. Verify, accept and close. The requester verifies the outcome against the request. Decision point. Accepted: the SDO Workplace Officer records the acceptance, updates the IoL access register and, where relevant, the AW-13 licence register, closes the request and informs the Chair. End: request closed and access records updated. Not accepted: HQ IT reworks under its procedures, step 8.

10. Change access on role change. A role change notified by AW-07 or AW-08 is a leaver from the old role and a joiner to the new one: the line manager confirms the new profile, the SDO Workplace Officer raises the removal of the old role's access with HQ IT and each data owner, and the new role's access follows the request route. [CONTROL] Access accumulated in the old role is removed, not carried over. Next: step 11 for the old role's access, step 2 for the new role's.

11. Remove access on leaving, the same day. AW-07 or AW-08 notifies the leaving date in advance. On the last working day the SDO Workplace Officer confirms with HQ IT that the identity and email account is disabled, with each data owner or system administrator that system access is removed, and with the HAO that any approval routing held by the leaver is removed under AW-05, and records the confirmations; physical access ends under AW-14 in the same action and IT hardware returns under AW-13. [CONTROL] Revocation is confirmed in writing, not assumed; a leaver found with live access after the last working day is a non-conformity under AW-24 and an AW-16 incident. Decision point. All confirmations received: End: leaver access removed and confirmed. A confirmation outstanding: escalated to HQ IT and the HAO the same day; the record stays open until it is received.

12. Run the periodic access review and report. Quarterly, within 20 working days of quarter end, the SDO Workplace Officer issues each data owner a list of every person with access to their system or dataset, the level held and the date last used where the system reports it, and issues the HAO the privileged access register. The data owner confirms, reduces or removes each entry and signs; the HAO confirms or withdraws each privileged account. HQ IT actions removals within 5 working days and licence counts are reconciled to users. The SDO Workplace Officer reports review completion, revocation timeliness, privileged accounts and routing changes to the HAO and AW-16. [CONTROL] An unsigned review is an open non-conformity reported to AW-24. End: review signed, removals actioned, report issued.

13. Report faults and security incidents. Faults and outages go to the HQ IT service desk; the SDO Workplace Officer logs the reference where the issue affects teaching, assessment or a deadline. Suspected security incidents (lost device, phishing, unexpected access, data sent to the wrong recipient) are reported to HQ IT and the AW-16 process owner within 1 hour of discovery, before any local investigation. An outage affecting a session escalates to the HAO and, where relocation is needed, to AW-14; its impact is recorded for AW-06. Decision point. Resolved: End: ticket closed with the HQ IT reference. Not resolved within the HQ IT service standard: escalated to the HAO; the ticket stays open.

Exception routes. Urgent cover access: the data owner may approve verbally, with written approval within 1 working day and a 30-day expiry; HQ IT clearance follows where the access is non-standard [SDO to confirm: IOL-OPS-009 v0.1 has no urgent route for IT; this procedure keeps the AW-15 v0.1 cover route because teaching cannot wait for a full review]. Emergency change to restore service on a system IoL administers: the system administrator acts and records the change within 1 working day for the HAO's ratification. Leaver notified late: removal the same day as notification, and the lateness reported to AW-07 or AW-08. Access removed under AW-09: implemented through step 11 on the HAO's instruction, without a form. HQ IT unable to provide a service: the request is returned with HQ IT's reasons and closed or resubmitted as a purchase under AW-10 [HAO to confirm].

5. Service standards

6. Records, retention and controls

Records are kept in the Administration Affairs (SDO) central repository and in the systems named below, and retained for a minimum of seven years or the period required by the Dubai Department of Finance, whichever is longer.

Key controls. (1) Every access traces to an AW-07 or AW-08 notification or a submitted form and a data owner approval. (2) Only Annex A services bypass Chair endorsement. (3) No non-standard IT service is provisioned without HQ IT security clearance. (4) Cost is approved at the AW-05 tier for the total value; no splitting. (5) Access is least-privilege; privileged access is named, separate and expiring. (6) The quarterly review is signed by every data owner, not by the register's keeper. (7) Leaver access is removed and confirmed in writing on the last working day, with AW-05 routing removed the same day. (8) Repository write access is limited to the Document Controller. (9) No software outside the licence register. (10) Returned requests close after 10 working days.

OBEF touchpoint. None.

7. Performance measures

8. Change control