Account Management

Introduction

Computer accounts are the means used to grant access to Texas Tech University Information Resources.  These accounts provide a means of providing accountability, a key to any computer security program, for Information Resources usage.  This means that creating, controlling, and monitoring all computer accounts is extremely important to an overall security program.

Purpose

The purpose of the Texas Tech University Account Management Security Policy is to establish the rules for the creation, monitoring, control, and removal of user accounts.

Audience

The Texas Tech University Account Management Security Policy applies equally to all individuals with authorized access to any Texas Tech University Information Resources.

Account Management Policy

1. All user accounts created must have an associated request and approval that is appropriate for Texas Tech University.
2. All users must acknowledge the Texas Tech University Information Resources eRaider Terms of Use and/or other applicable security acknowledgement and nondisclosure agreements before access is given to an account.[1]
3. All user accounts must be uniquely identifiable using a centrally assigned user name from the IT Division.[2]
4. All passwords for accounts must be constructed in accordance with the Texas Tech University Password Policy.[3]
5.  All user accounts must have a password expiration that complies with the Texas Tech University Password Policy.[4]
6. Accounts of individuals on extended leave will be disabled.
7. All new user accounts that have not been activated within 120 days of creation will be disabled.
8.  System Administrators or other designated staff:[5]
   1. are responsible for removing the accounts of individuals that change roles within Texas Tech University or are separated from their relationship with Texas Tech University
   2. must have a documented process to modify a user account to accommodate situations such as name changes, accounting changes and permission changes
   3. must have a documented process for periodically reviewing existing accounts for validity
   4. are subject to independent audit review
   5. must provide a list of accounts for the systems they administer when requested by authorized Texas Tech University management
   6. must cooperate with authorized Texas Tech University management investigating security incidents