Perceptive Content: Staff and Faculty Security Audit Process

Quick Search

Once a year, at the beginning of the fall semester, OIT will conduct a manual security audit of Perceptive Content, designed to remove unnecessary and expired access to the system. This process is performed via three steps (for Staff and Faculty):

1. Steps
   1. Manager Access Notices
   2. Deactivation of account
   3. Employee Access Removal

Steps

1. Manager Access Notice (Manual and Annual)
   • Timeline: Once a year, during the Fall Semester (or as time permits) we will create a ticket (that can be resolved through email) for each manager (see below for an example). This Ticket will ask the managers to confirm the permissions for their employees they manage by auditing a spreadsheet.
   • Using organizational data in SAP, the managers of users with Perceptive Content access are sent a notice with an attached spreadsheet asking them to confirm the necessity of the access for a given employee. In cases where the user reports to a vacant position, the next highest occupied position in the user's reporting tree is used instead.
   • Upon receipt of the security audit response, OIT will remove the requested access within five business days and resolve the ticket when complete.
   • Please refer to the Manager Expectations section for additional information.
   •  
2. Second Notices due to no response (second and final attempt)
   • Timeline: Approximately one week before the final deadline we will send another "Friendly Reminder" that all access will be removed if the Audit is not returned.
3. Employee Access Removal (only if no response was received)
   • Timeline: After the stated deadline in the FIRST and SECOND notices, we will remove the employee's access.
     They and the managers will have to reach out to regain access if needed.

Manager Expectations

1. Managers receive an email outlining the process (below is an example):
   They should open the "Client Portal View" at the bottom of the email, unless you have TDNext access.
   
   
    
2. Review the attached spreadsheet in the email (example below):
   
    
3. Denote any access that should be removed by entering REMOVE into column G (DO NOT Remove the row yourself)
4. Reply to the email and either attach the edited spreadsheet or indicate No Changes in the body of the email
5. The TeamDynamix ticket will be updated and resolved with any access changes made

Deactivation for one month, then full removal

1. If no response is received by the end date, we will deactivate the account(s) and place the ticket on hold for a month.
2. If the end user reaches out within that month to ask about their access, we will refer them to their manager and resend the ticket.
3. If no communication is received, we will remove all groups and resolve the ticket.