Security Process - Removing User Access Resulting from Job Change

Question

My question is Security process related specific to internal employee transfers (new job responsibilities).  My organization has typically added requested access to a users' account, and infrequently removed access no longer required.  In the event where there has been a job transfer, the user may have more security capability than required in the new job.  In the current internal process, the security administrator has no visibility to employee transfers.   I'm seeking input on practicle ways to remove access no longer required without impacting the user with downtime should a proactive end of access date be dictated.  Recommendations?

Answer 1

>
Sandi Ward wrote:
> Ideally your HR Admin should notify you of such changes, or the manager responsible for the staff member.
> We use position based security, but because HR did not always tell the security admin that a user had changed position, we found that users lost access (users were moved to brand new positions with no access assigned). First thing security knew about it was when the user complained.
>
> ... So we had our ABAPers whip up an auto generated e-mail whenever a position was changed, the e-mail was sent to security team, and service desk.  They used the HR dynamic actions as the basis of the programme.
>
> Even if your access is not linked to positions you could still receive notification of a change of position for a given personnel record.
Sandi,
You are correct, ideally the HR admin should inform security but they do not.  However, there is a report that will display all the new positions without security role assignments.  You can use the report to be pro-active with assigning roles to positions.  Of course this is assuming you have basic role assignments for positions (clerks, office managers, directors, etc).  I use the output as a source file for my SECATT scripts to populate roles to positions.
Regards,
-John N.