9-4 Information Technology Professionals Policy -Section III: Access Control Policy

Return to Information Technology Professionals Policy Table of Contents

What’s on this Page

III. Access Control Policy

Read next: Section IV: Business Continuity Management Policy

This Policy establishes logical access controls Local Information Service Providers must implement to secure Local Agency IT resources and data.

1. Secure Log-On Procedures
   Access to Local Agency IT resources and data must be controlled by secure log-on procedures.
   1. Logon Banners
      
      When technically feasible, logon warning banners must be displayed on any information system that hosts nonpublic services. Logon warning banner content must inform Users that Local Agency IT resources are for authorized County/Local Agency business only, User activities may be monitored, and Users have no expectation of privacy.
   2. Unsuccessful Login Attempts
      
      The number of consecutive attempts to enter an incorrect password must be limited. User IDs must be temporarily disabled (locked out) after a prescribed number of unsuccessful access attempts have been made as determined by Local Information Service Provider standards.
2. Password Management
   Password standards must be developed and implemented to ensure all Users follow proven password management practices. These password standards must be mandated by automated controls when technically feasible and include but are not limited to the following:
   1. Prohibiting the storage and transmission of passwords in clear text;
   2. Prohibiting use of default vendor passwords;
   3. Changing temporary password at the first login and reset;
   4. Changing passwords at regular intervals;
   5. Development of procedures to verify a User’s identity prior to providing a replacement password (i.e., password reset); and
   6. Enforcing choice of strong passwords.
3. Use of System Utilities 
   Use of system utilities that are capable of overriding other controls must be restricted.
   1. Access to system utilities must be limited to Users and Administrators with an approved need to run or use those utilities.
   2. Temporary access may be granted only after a business requirement for access has been documented and approved.
   3. When technically feasible, unneeded system utilities, options, and/or services must be removed or disabled.
4. Session Time-Out
   As determined by Local Information Service provider standards, security measures must be implemented to require authentication or re-authentication after a prescribed period of inactivity for desktops, laptops, or any other Local Agency IT resources where authentication is required.
5. Connection Limitation
   Restrictions on connections must be used to provide additional security for high-risk application or remote communication capabilities. As determined by Local Information Service Provider standards, the following controls must be applied and maintained:
   1. Connection time (e.g., office hours);
   2. Connection location; and
   3. Requiring re-authentication at timed intervals.
6. Application Access Control
   To prevent unauthorized access to information stored in Local Agency application systems, access must be restricted to Users and support personnel whose work assignment requires access to those applications.

Back to top