Provisioning, deprovisioning and access reviews

Skills you'll practise

• Design access levels that give each role only the doors and times it needs
• Process joiner, mover and leaver changes with the right approvals and confirm they reached every controller
• Handle lost credentials, temporary access and keys or combinations so no uncontrolled access remains
• Run an access review with area owners and record the outcome
• Reconcile active credentials against an HR list and find access that should have been removed

Course outline

1. 1.Provisioning, deprovisioning and access reviewsVideo · 2 min
2. 2.Access levels and approvalsLesson · 16 min
3. 3.Joiners, movers, leavers and lost credentialsLesson · 20 min
4. 4.Access reviews and auditsLesson · 18 min
5. 5.Provisioning, deprovisioning and access reviews: knowledge checkKnowledge check · 18 questions
6. 6.A contractor who left last month opened the plant roomScenario
7. 7.Final exam10 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• NIST SP 800-53 Rev. 5: PE-2 Physical access authorizations, PE-3 Physical access control, PE-6 Monitoring physical access, PE-8 Visitor access records, PS-4 Personnel termination, PS-5 Personnel transfer
• CISA: Insider threat mitigation (an insider is anyone who has or had authorized access; combine physical security, personnel awareness and information-centric measures)
• NIST SP 800-116 Rev. 1: Guidelines for the Use of PIV Credentials in Facility Access (threats: identifier collisions, revoked cards, skimming, sniffing, cloning; Controlled / Limited / Exclusion areas and 1 / 2 / 3 authentication factors; US federal guidance used here as an example)
• General access control installation and administration practice (starter content; needs subject review)