Send us the RFP Sign up free
Sign up free Send us the RFP
Back to course

P4 Shared Accounts and Offboarding

0% done: 0 of 6 lessons

Lesson 6 of 6 · Video

The quarterly review

Progress is saved on this device only. Keep it across devices with a free LFW account.

Curriculum0 of 6 done
2 minutes 7 seconds. Captions are on. Recorded on WordPress Playground with the fictional City of Wrenfield site and fictional people, then slides. The narration is a synthesized voice; a recorded voice replaces it later.

Every three months, compare the inventory with reality, remove access nobody needs, check two-step sign-in and recovery details, and confirm renewals, then report what you found.

Notes

Step 1 of 8

Start here

The inventory from lesson 1 starts going out of date the day you finish it. People join and leave, vendors come and go, someone adds a new service with a card, a recovery phone number changes. A review every three months catches the drift while it is still small.

This lesson is the review, and it takes about an hour once the inventory exists.

Step 2 of 8

When

Put four dates on the calendar for the year, such as the first week of January, April, July and October. Pick a time that is not the busiest for meetings or budget work. Name a backup who runs it if you cannot.

Step 3 of 8

The review, account by account

Open the inventory and the current staff list side by side. For each account, check:

  1. People: does everyone with access still work here, or still work with us? Remove anyone who does not.
  2. Roles: is each person's role still the smallest that fits their job (lesson 3)?
  3. Inactive accounts: has anyone not signed in for months? CISA's goal 3.D calls for reviewing user access and disabling accounts inactive for a set period, and gives 30 days as an example. Many services show the last sign-in date.
  4. Two-step sign-in: is it on for every person, and is the method still one they can reach?
  5. Recovery details: do recovery emails and phones point to role mailboxes or current people?
  6. Vendors: does every vendor account match an active contract (lesson 5)?

Fix what you can on the spot. Write down what you cannot.

Step 4 of 8

The address, every quarter

The domain is the one account that takes everything down if it lapses. Each quarter:

  • check the expiration date,
  • confirm auto-renew is on, with a payment method the institution controls and that will not expire first,
  • confirm the registrant and contacts are current,
  • if you have a .gov domain, confirm the contacts in your get.gov account are current.

Step 5 of 8

Look for new accounts

Since the last review, has anyone started a new service? Check:

  • card statements and invoices for the quarter,
  • new pages on your site that embed outside services,
  • questions to department heads: "Did you sign up for anything new for the website or social media?"

Add what you find to the inventory, with an owner.

Step 6 of 8

The password manager

Review the shared vaults:

  • Does each vault's membership match who should have access?
  • Are there passwords for services that no longer exist? Archive or remove them.
  • Is any shared password one that a departed person knew, and was missed?

Step 7 of 8

Record and report

At the end, write a short record:

  • the date and who did the review,
  • how many accounts were checked,
  • what was fixed (people removed, roles lowered, recovery details updated),
  • what is still open, with an owner and a date.

Send it to your manager, and keep a copy with the inventory. If you write the monthly website report from Running a Public Website Day to Day, add the open items to its decisions section.

Step 8 of 8

What a good year looks like

After four reviews, every account has an owner, at least two people can get in, nobody who left still has access, every login has two-step sign-in and no renewal comes as a surprise. When someone asks "who controls our website?", you can answer in a minute.

Sources

Transcript

Synthesized narration; a recorded voice replaces it later.

  1. 0:00The inventory starts going out of date the day you finish it.
  2. 0:03People join and leave, vendors come and go, a recovery phone number changes.
  3. 0:08A review every three months catches the drift while it is still small.
  4. 0:12Put four dates on the calendar for the year, such as the first week of January, April, July and October, and name a backup who runs it if you cannot.
  5. 0:22Open the inventory and the current staff list side by side.
  6. 0:26Then, for each account, the six checks.
  7. 0:29Here is the Users screen of a fictional city site.
  8. 0:32One: people.
  9. 0:34Does everyone with access still work here, or still work with us?
  10. 0:37Last year's summer intern still has an account.
  11. 0:40Remove anyone who does not.
  12. 0:43Two: roles.
  13. 0:44Is each person's role still the smallest that fits their job?
  14. 0:48Three people here are administrators.
  15. 0:50Does each of them need to be?
  16. 0:52Three: inactive accounts.
  17. 0:55Has anyone not signed in for months?
  18. 0:57CISA's goals call for disabling accounts inactive for a set period, and give 30 days as an example.
  19. 1:04Four and five: is two-step sign-in on for every person, and do recovery emails and phones point to role mailboxes or current people?
  20. 1:13Six: vendors.
  21. 1:14Does every vendor account match an active contract?
  22. 1:17A web design firm is an administrator here.
  23. 1:20Is that contract still running?
  24. 1:23Then the address.
  25. 1:24The domain is the one account that takes everything down if it lapses.
  26. 1:28Check the expiration date, that auto-renew is on with a payment method the institution controls, and that the contacts are current.
  27. 1:36Look for new accounts in the quarter's card statements and invoices, and ask department heads.
  28. 1:41Review the password manager's shared vaults.
  29. 1:44Then write a short record: who did the review, what was fixed, and what is still open, with an owner and a date.
  30. 1:52Your task.
  31. 1:53Put four review dates on the calendar and name your backup.
  32. 1:56Run the first review now, with the six checks for every account.
  33. 2:00Check your domain's expiration, auto-renew and contacts.
  34. 2:03Write the record and send it to your manager.

Task

Your task at your institution

Quiz

4 questions. Choose one answer for each, then check them. Each answer shows its reason.

1. What is the quarterly review comparing?
2. An account has not been used in three months. What does CISA's goal 3.D suggest?
3. Your domain expires in seven weeks and auto-renew is off. What do you do?
4. What should the review produce?
Show the answers
  1. B. The inventory and staff list with who actually has access. Access drifts. The review finds what changed without anyone noticing.
  2. B. Review access and disable accounts inactive for a set period. CISA gives 30 days as an example period for disabling inactive accounts.
  3. B. Renew it or turn on auto-renew now, with an institutional payment method. A lapsed domain takes the website and usually the email down with it.
  4. B. A dated record of what was checked, found and fixed, sent to your manager. The record shows the review happened and what is still open.