Skip to main content

2.11 Logical Access Security Standard

Effective Date: SeptemberJuly 1, 2025
Revised Date: SeptemberJuly 22,1, 20252026

1. Purpose

This procedureStandard establishes standardsthe mandatory requirements for account creation, management, and information system management across all systemstechnology resources and accounts within theArkansas university.State ItUniversity (A-State). The purpose of this standard is designed to alignensure withthat guidance from the National Institute of Standardsaccounts and Technologyaccess (NIST),controls Arkansasare Legislativemanaged Audit,in a manner that protects university data and themitigates Criminalinstitutional Justice Information Services (CJIS) Security policy, while incorporating operational considerations specific to our user environment.risk.

2. Scope

This procedurestandard applies to all users,faculty, including employees,staff, students, contractors, affiliates, and vendors who access any information system, application, or service under the controlmembers of the Arkansas State University JonesboroSystem campus.(ASU AnySystem) mentioncommunity ofwho specificaccess teams,A-State userinformation groups,technology managementinfrastructure groups,and orassociated leadershipresources. teamsThis willstandard only be applicableapplies to theirall Jonesboroinstitutional campusplatforms counterpartand unlessservices explicitlyand statedapplies otherwise.in all work settings, including on campus, remote work locations, and approved telecommuting arrangements.

3. Definitions

Technology Resources – The machines, devices, systems, services, and related components used in information processing. This sectionincludes:

  • Machines, devices, and transmission facilities used in information processing, such as computers, word processors, terminals, telephones, cables, software, and related products.
  • Devices used to process information through electronic capture, collection, storage, manipulation, transmission, retrieval, and presentation of information in the form of data, text, voice, or image, including telecommunications and office-automation functions.
  • Any component related to information processing and wired or wireless telecommunications, including hardware, software, services, planning, personnel, facilities, and training.
  • Procedures, equipment, and software designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, along with associated personnel such as consultants and contractors.
  • All email accounts issued by A-State.

User – Any individual, whether authorized or unauthorized, who makes use of any university technology resource from any location. This includes faculty, staff, students, contractors, affiliates, and members of the proceduresystem servescommunity.

to

System assignCommunity clear- ownershipAny person who accesses the ASU System’s IT infrastructure who is not classified as a member of the faculty, staff, or enrolled student.

Systems Authority - ASU System delegates oversight of particular systems to the head of a specific unit of the ASU System or to an individual faculty member, in the case of technology resources purchased with research or other funds for which he or she is personally responsible.

Systems Administrator - A Systems Authority may designate another person as “Systems Administrator” to manage the particular system assigned to him or her. Systems Administrators oversee the day-to-day operation of the system and are authorized to determine who is permitted access to particular technology resources.

Certifying Authority - This is the Systems Administrator or other ASU System authority who certifies the appropriateness of an official ASU System document for electronic publication in the course of ASU System business.

Specific Authorization - This means documented permission provided by the applicable Systems Administrator.

Privileged Access – Authorized access that allows a user or account to perform administrative or security-sensitive actions on a technology resource that a standard user cannot perform.

Access Control (Logical Access Control) - The administrative and technical measures used to identify and authenticate a user or system and then authorize, enforce, and audit the level of access that identity is authorized for based on least privilege and business need. This includes, but is not limited to, username and password, Multi-Factor Authentication mechanisms, and role or group-based authorization, such as RBAC.

4. Responsibilities

All university personnel involved in the configuration, maintenance, and review of controls necessary componentsto forensure the effective management and implementationsecurity of thedigital logicalinstitutional accessdata. securityThis procedure.includes:

  • Chief Information Officer (CIO): - Responsible for establishingthe executive sponsorship, governance, and coordinatingoversight of the campus’University’s information systems management strategy,processes ensuringwithin alignmentthe withscope organizationalof objectivesthis standard. Ensures that applicable regulatory, statutory, and regulatorycontractual requirements.

    • obligations
  • are identified, translated into actionable controls, and operationalized across institutional systems and processes.

    ITSIT Security Team:Team – Responsible for monitoring the campus’ digital infrastructure for both internal and external threats and verification of compliance with organizational objectives and regulatory requirements. This includes the investigation and response of reported or identified security incidents and maintenance of monitoring tools.

  • ITS Systems Team:Team - Responsible for the campus’ domain-level system administration. Responsible for designing, documenting, maintaining, and overseeing enterprise infrastructure, system configurations, and access to control frameworks. This includes the active management and documentation of all information system accounts. This team establishes the standards and procedures to which endpoint-level support activities must adhere.

  • ITS HardwareEndpoint Team:Technicians - Responsible for the campus’management endpoint-leveland systemsupport administration.of Endpoint-levelinstitutional administrationtechnology willresources maintainacross infrastructurethe inUniversity. alignmentThis includes the audit and remediation of deployed resources to ensure they comply with standard configuration requirements, the standardsappropriate use of elevated or standard accounts, and procedures designed by the ITSprimary Systemssupport Team.

  • Departmentsource of Humantechnology Resources:resource Responsible for conveying employee employment status to those responsible for organization-level system administration.
  • Office of the Registrar: Responsible for conveying student registration status to those responsible for organization-level system administration.
users.

4.5. ProcedureStandard Exceptions

The Chief Information Officer for the Jonesboro Campus is authorized to review and approve exceptions to this procedurestandard when organizational needs justify a deviation, and the associated risks are deemed acceptable. All exceptions must be documented, including a defined scope, a scheduled review date, and incorporate compensating controls when appropriate. The CIO may delegate this authority as necessary but retains overall accountability for exception management and review.

5.6. Passphrase Requirements

This section of the procedurestandard serves to establish four account security levels and outline their respective passphrase requirements. These account security levels serve to accommodate varying account passphrase requirements based on the sensitivity of systems accessed. Universal account passphrase requirements apply to all security levels unless specified otherwise. This section also outlines requirements for local account passphrases but does not place them at a specific security level as their use outside of emergencies is stronglyexplicitly discouraged.restricted.

Account Classification Matrix

Security Level 1 AccountsSecurity Level 2 AccountsSecurity Level 3 AccountsSecurity Level 4 Accounts
Student AccountsSystem Administrator Security Level 1 AccountsSystem Administrator AccountsService Accounts
Faculty AccountsCJIS User Accounts  
Staff Accounts   
CUI User Accounts   

Passphrase settings are not considered enforced unless systematically required. 

  1. Universal Account Passphrase Requirements

    1. Prohibited Passphrases:


      Passphrases must not appear on known compromised passphrase lists or commonly used passphrase databases. Passphrases will be screened against such lists during passphrase creation and change. A mechanism will be used to detect user passphrases that become compromised after being selected by the user.

    2. Passphrase ReuseReuse:

      (i)

      • A user’s passphrase cannot match their last 24 set passphrases within the campus’ information systems.

        • (ii)

      • Users must create unique passphrases for each individual system to which they are given access.

        • (iii)
      • Reuse of personal account passphrases for business purposes is strictly prohibited.

      New User PassphrasesPassphrases:
      Users will be required to change their initially assigned passphrase.

    3. Multi-Factorfactor Authentication (MFA)Authentication:
      Users will be required to authenticate using a multi-factor solution during their first authentication of the day for each individual resource. This authentication will be valid for a period of 4four (4) hours. Security Level 3 and 4 accounts are excluded from this universal requirement and will instead follow a stricter requirement as outlined in their section.

    4. Alternative Authentication SolutionsSolutions:

      Other technologies for user identification and authentication, such as biometricsbiometrics, (e.g.,including fingerprint verification,verification or signature verification)verification, and use of hardware tokenstokens, (e.g.,such as smart cards)cards, will be considered and made available for users, if appropriate. Security Level 3 and 4 accounts are excluded from this universal requirement and will instead follow a stricter requirement as outlined in their section.

    5. Duplicated PassphrasesPassphrases:

      All user passphrases will be unique and cannot match the passphrase of another account in the campus’ information system. This includes any additional account a user may havehave, (such as an administrator account)account, but excludes accounts synced to the same passphrase using passphrase synchronization at the domain level.

  2. Security Level 1 Accounts

    1. Passphrase LengthLength:

      Account passphrases must be a minimum of 15 characters in length.

    2. Passphrase ComplexityComplexity:

      Passphrases must include at least one uppercase letter, one lowercase letter, one number, and one special character. Users are strongly discouraged from using repetitiveRepetitive or sequential characterscharacters, (e.g.such ‘aaaaaa’,as ‘1234abcd’).“aaaaaa” or “1234abcd,” cannot be present.

    3. Passphrase RotationRotation:

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout ThresholdThreshold:

      Accounts will be temporarily disabled for 15 minutes after five (5) consecutive failed attempts within a 15-minute period. At the end of this 15-minute lockoutlockout, the user's account will automatically unlock, and the process will restart. Passive authentication attempts are excluded from this requirement.

  3. Security Level 2 Accounts

    1. Passphrase LengthLength:

      Account passphrases must be a minimum of 20 characters in length.

    2. Passphrase ComplexityComplexity:

      Users are strongly discouraged from using repetitiveRepetitive or sequential characterscharacters, (e.g.such ‘aaaaaa’,as ‘1234abcd’).

      “aaaaaa”

      or “1234abcd,” cannot be present. No other complexity requirements are imposed.

    3. Passphrase RotationRotation:

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout ThresholdThreshold:

      Accounts will lock after 5five (5) consecutive invalid logon attempts by a user during a 15-minute period. This account will stay locked until an A-State representative releases the account. Passive authentication attempts are excluded from this requirement.

  4. Security Level 3 Accounts

    1. Passphrase LengthLength:

      Account passphrases must be a minimum of 20 characters in length.

    2. Passphrase ComplexityComplexity:

      Users are strongly discouraged from using repetitiveRepetitive or sequential characterscharacters, (e.g.such ‘aaaaaa’,as ‘1234abcd’).

      “aaaaaa”

      or “1234abcd,” cannot be present. No other complexity requirements are imposed.

    3. Passphrase RotationRotation:

      Account passphrases will expire after a period of 365 days. This expiration will force the user to set a new account passphrase on their next login attempt.

    4. Account Lockout ThresholdThreshold:

      Accounts will lock after 5five (5) consecutive invalid logon attempts by a user during a 15-minute period. This account will stay locked until an AStateA-State representative releases the account. Passive authentication attempts are excluded from this requirement.

    5. Enhanced MFA RequirementsRequirements:

      Users will be required to authenticate using a multi-factor solution upon each account authentication.

    6. EndpointTechnology ConfigurationResource Configuration:
      EndpointsTechnology resources will be configured to blockrestrict securitySecurity levelLevel 3 accounts from directlydirect accessing them.access. Instead, securityprivileged levelaccess 3 accounts willshall be requiredgranted tovia accesselevation anfrom endpointa usingSecurity their security levelLevel 2 account and then elevate their access using system system-specific solutionssolutions, (such as Sudo on Linux or RunAs on Windows).

      RunAs.

  5. Security Level 4 Accounts

    1. Passphrase LengthLength:

      Account passphrases must be a minimum of 30 characters in length.

    2. Passphrase ComplexityComplexity:


      Account passphrases must be sufficiently complex and resistant to brute-force or dictionary attacks. Use of randomly generated passphrases is required      .required.

    3. Passphrase RotationRotation:


      Account passphrases will expire after a period of 730-730 days. If an employee who has accessed a securitySecurity levelLevel 4 account leaves the organization, this passphrase will be reset.

    4. AccountPassphrase Lockout ThresholdAccess:


      Security levelLevel 4 account information will be stored in a single passphrase management system. Access to passphrases in this system by administrators must be logged with access logs retained for a minimum of three years.

    5. Early Passphrase RotationRotation:


      When an employee who has accessed a service account leaves the organization, that securitySecurity levelLevel 4 account passphrase must be reset within 12 hours of the employeesemployee's account being disabled. A passphrase reset of this nature will be considered an emergency priority for change management purposes.

      6. 7.

    Local
    6. Accounts

  6. In alignment with the A-State Technology Resource Management Standard, local accounts will be restricted as follows:

    Local Account Passphrase Requirements:Requirements

    1. Technician Generated Accounts

        • Local user or administrator accounts created by either domain-levelendpoint administratorstechnicians or endpoint-levelsystems administrators for specific use cases will have their passphrases changed every 60 days. Passphrase age will be tracked within an EDR when available to ensure compliance.

        • Account passphrases will be a minimum of 1525 characters with at least one uppercase letter, one lowercase letter, one number, and one special character.

        • Local user or administrator accounts created by either domain-levelendpoint administratorstechnicians or endpoint-levelITS administratorsSystems forTeam specificmust usebe casesdocumented and have an approved CIO exception on domain joined endpoints will not be accessible by standard users without written approval by the CIO.

          file.

        • Local user or administrator accounts, other than a system system-generated default administrator account, will not be permitted on endpoints in areas such as the University Police Department, Information and Technology Services department, the University Data Center, and any other area containing controlledRegulated unclassifiedor information (CUI) to increaseConfidential data security.

          as classified by the Data Security and Classification Policy.
  • Default

    8. Administrator Accounts

    1. Local Administrator PassphrasePrivileges

    Solution
    (LAPS)
      will
    • Standard beusers utilizedshall fornot thehave generation and management of all defaultstanding local administrator accounts.rights.
      • These
    • Privileged accountsaccess shouldshall be limited to authorized A-State ITS personnel.
    • Authorized privileged access shall not be accessedgranted unless a severe technical issue prohibitsvia the use of astatic domainlocal administratoraccounts account.and will instead utilize an approved privileged access management (PAM) solution, such as Microsoft Local Administrator Password Solution (LAPS). Upon useuse, this passphrasepassword will thenautomatically be regenerated.

    • Account Classification Matrix

    Security Level 1 Accounts

    Security Level 2 Accounts

    Security Level 3 Accounts

    Security Level 4 Accounts

    Student Accounts

    System Administrator Security Level 1 Accounts

    		System Administrator AccountsService Accounts
    Faculty AccountsCJIS User Accounts  
    Staff Accounts   
    CUI Accounts   

    6.9. Passphrase Enforcement and Monitoring MechanismsControls

    ThisA-State sectionshall ofmaintain a supplemental Logical Access Password Enforcement and Monitoring Procedure, separate from this standard, that outlines the proceduretechnical outlinescontrols mechanismsITS availableutilizes tofor password enforcement and password compliance ensuring this monitoring is maintained in accordance with state, federal, and university regulations and policies. At a minimum, this will include and establish the Arkansasfollowing State University Jonesboro campus for passphrase management and enforcement. It serves to offer direct solutions to the requirements outlined in section three of this procedure.subjects:

      • Passphrase Procedure Enforcement

        1. UtilizeHow Fine-Grained Passphrase Policies (FGPP)

          FGPPare allows system administratorsconfigured to applyensure differentcompliance passphraseswith andthis lockout settings to separate user groups. This approach will allow for more granular control of users' passphrase requirements. This work will be completed by a Domain-level System Administrator. This requirement will be applied to all GPO’s and to all university owned endpoints.

          standard.

        2. Enable Passphrase Complexity & Length Requirements

          Alternatively,How passphrase complexity and length canrequirements beare set via group procedureconfigured to ensure eachcompliance userwith groupthis is meeting their unique requirements. This work will be completed by a Domain-level System Administrator. This requirement will be applied to all GPO’s and to all university owned endpoints.

        standard.
      • How

        Enable Breached Passphrase Detection

        1. Entra Passphrasepassphrase Protectionprotection for Active Directory (AD)
          Configurationis of Entra Passphrase Protectionconfigured for both on-premises and cloud-based accounts in compliance with this standard.

        2. How CrowdStrike compromised password workflows are configured to ensure compliance with this standard.

      10. Access Management Requirements

      To ensure compliance with university standards, the ITS Systems Team will allowmaintain, for globalsupport, and customcentrally banned passphrase lists to be utilized during user passphrase changes. This prevents users from setting a compromised or weak known passphrase that a secondary system would then detect and correct, limiting user frustration during the process. This work will be completed by a Domain-level System Administrator. This requirement will be applied to all GPO’s and to all university owned endpoints.

  • Enable CrowdStrike Passphrase Detection Workflows

    1. CrowdStrike Compromised Passphrase Workflows
      Access to CrowdStrike's Identity Protection module allows for custom workflows to be deployed in our environment. CrowdStrike compares the hash of our users' passphrases against the hash of passphrases found in their datasets. The Identity Protection module already flagsadminister user accounts with compromisedthe orinstitutional duplicate passphrases. We can then enable an automated workflow that sends an email to users with this “flag” notifying themgoal of thereducing compromised passphraseoperational and forcingcybersecurity risk. The ITS Systems Team shall maintain a passphrasesupplemental changeLogical on their next login. This work will be completed by a Security Team Member.

  • Layering Security Resources
    1. Customized Approach

      The ideal approach for passphrase security in our environment will be to layer available resources. Passphrase policies increasing the minimum length and complexity for specific user groups as outlined in section 3 will minimize the ability for dictionary attacks or brute force attacks. Microsoft’s Entra Passphrase Protection ensures that users setting up a new passphrase are not using an already compromised passphrase or one from a banned passphrase list. Finally, passphrases that become compromised or are duplicated after being set will be detected and reset automatically using CrowdStrike’s automated workflows.

    • 7.Access Account Management Requirements

    Procedure, separate from this standard, that outlines how these resources are configured, monitored, and managed.

    This sectionprocedure ofwill, at a minimum, include and establish the procedurefollowing willrequirements:

    serve to outline operational account control requirements to ensure user accounts are handled appropriately from their creation to their deletion. The lifecycle of each account type may vary depending on the criticality of resources accessed, but standardized procedures will limit organizational risk over time.

    • All user accounts must be uniquely identifiable using the assigned username.

    • All user accounts will follow a defined and documented naming scheme.

    • Shared accounts are not permitted for access to Arkansas A-State University – Jonesboro information systems. Though “shared” by administrators, Serviceservice Accountsaccounts are not considered shared accounts for the purposes of this requirement.

    • Non-organizational user accounts, such as temporary or guest accounts, are not permitted for access to Arkansas State University – Jonesboro information systems.

    • Any non-organizational user access must be granted through the existing sponsored account process.

    • All user accounts must have a passphrase that complies with the requirements in their respective security level as outlined in section three of the logical security access procedure.

    • Concurrent connections may be limited for technical or security reasons.

    • All non-administrator user accounts must be disabled at 5:00 P.M. upon the date of their last scheduled day of work as listed in the termination workflow.

    • Any account accessed by a terminated user that must persist past their termination (ex. Service Accounts) will be reset within 12 hours of their account being disabled.

    • All endpoint-level and domain-level administrator accounts must be disabled at 12:00 P.M. upon the date of their last scheduled day of work as listed in the termination workflow. Users will be allowed to continue access to information systems via their standard user account.

    • All user accounts meeting immediate or retroactive termination criteria will have their account immediately disabled. This disablement will occur for both standard and administrative user accounts.

    • All service accounts will be thoroughly documented by the domain-levelITS systemsSystems administrator,Team, with purpose and any automated tasks executed defined. While a service account's purpose may evolve over time, it is the responsibility of the domain-level system administrator to review this on a regular basis and update the documentation in alignment with active account management.

    • Arkansas State University Jonesboro informationInformation system accounts will be created so that they enforce the most restrictive set of rights, privileges, or accesses required for the performance of tasks associated with their assigned job duties.

    • Information system accounts with rights, privileges, or accesses extending into the administrative management of endpoints, information systems, or other restrictedtechnology resources will result in an administrative account being created for the user. This administrative account will exist solely for the completion of assigned job duties extending beyond that of a standard user account.

    • All information system accounts will be actively managed. Active management includes the acts of establishing, documenting, activating, modifying, disabling, and removing accounts from Arkansas State University JonesboroA-State’s information systems. This work will be completed by a domain-level system administrator.

    • Timelines

      and requirements for the timely disablement of accounts when their assigned user is no longer employed or associated with the organization.

    • Information system accounts are to be reviewed by domain-level system administrators on a monthly basis to identify inactive accounts. These accounts will be broken into two groups based on their owner’s status:

      • Student Accounts: If a student account is found to be inactive for a period of 365 days, the ownerITS ofSystems the account and the registration office will be notified of pending disablement. If neither group indicates the student is actively enrolled or will be enrolled in the following term and the account remains inactive for an additional period of 30 days, the account will be manually disabled. After an additional 30 days the account will be permanently deleted.
      • All Other User Accounts: If any non-student or non-service account is found to be inactive for a period of 30 days, the owner of the account, the manager of the owner of the account, and Human Resources will be notified of the pending disablement. If no group indicates that the owner of the account will return and the account remains inactive for an additional period of 15 days, the account will be manually disabled. After an additional 90 days the account will be permanently deleted.

      • 9-Month Faculty Considerations: Accounts of users on a 9-month contract will naturally end up being marked as “inactive” during the 30-day period outlined above. These accounts will be prevented from being disabled or deleted during the pending disablement notification by either Human Resources or Manager notification to the systems administrator.

    • Information system accounts are to be reviewed by domain-level system administratorsTeam to verify access is still relevant to their assigned duties.

      Review will include verification of:

      • Continued business justification for access.

      • Confirmation of appropriate role-based group membership.

    • Any access that is no longer justified must be revoked within 1one (1) business day of the review.

      • 11. Access Management Controls

      ReviewManagement willof beA-State conductedaccess incontrols alignmentshall withmeet the following schedule:requirements:

      • Security Level 1 and 2 accounts will be reviewed quarterly.

      • Security Level 3 and 4 accounts will be reviewed monthly.

    • Develop and implement a mechanism for information system account access to be reviewed outside of the monthly review schedule if employee roles are updated.

    • An independent audit review may be performed to ensure information system accounts are properly managed.

      1. Access Monitoring

        Access to information system resources will be logged and stored for a minimum of 7seven (7) years unless otherwise specified in the University Data Retention Procedure.Procedure. Suspicious access will be reported to the Security Team for evaluation.

      2. Account Management Tools

        Active management of accounts will be completed by domain-level system administrators. The specific tools or techniques for this management will be determined at the discretion of the Systems Team and ITS Leadership. Any tool or technique must follow industry best practices and cannot violate any University Policies.

      3. Account and Passphrase Manager Solution

        Service account usernames and passphrase information will be stored, transmitted, and tracked using a single passphrase management solution. Account information is not permitted for transmission via any other form of communication.

        4. This
      4. Service passphraseaccount managementpassphrases solution must include the ability to see who has accessed a passphrase and willshall be reviewedrotated uponwithin 24 hours of the receipt of a relevant user'sthe termination workflow.

        workflow for any user(s) that have accessed the service account.
      5. Account Management Documentation

        The domain-levelITS systemSystems administratorTeam will create adequate documentation of the account management processes, tools, workflows, and mechanisms required to actively maintain A-State access management controls.

      12. Use of Access Controls

      Arkansas State University invests substantial and sufficient resources to acquire and operate information technology assets, such as hardware, software, and Internet connections. ITS has a responsibility to manage its resources in the most efficient and effective manner possible and in compliance with all laws, regulations, and sound business practices, while at the same time protecting and preserving the right to academic freedom. Effective management of these resources will assure students, faculty, and staff adequate access to information and technology over the long term and ensures compliance with Arkansas State University JonesboroSystem informationpolicy. systemExamples accounts.of Thisappropriate documentationand willinappropriate beuses providedof uponaccess requestcontrols include, but are not limited to, the following:

      Appropriate Use of Access Controls

      • Users only use their assigned user account for bothaccess internalto andA-State externalresources.
        • auditing
      • Users purposesonly anduse willtheir beassigned reviewedauthentication onmethods, asuch yearlyas basis.MFA, Thisto documentationaccess willA-State beresources.
        • available
      • Using withinuniversity-approved 45password daysmanagement solution(s) to store access control information.
      • Reporting observed violations of this Logical Access Security Standard.

      Inappropriate Use of Access Controls

      • Sharing access credentials such as passwords with another user.
      • Sharing authentication methods such as access to MFA mechanisms with another user.
      • Providing inappropriate access to another user in violation of the effectiveprinciple dateof outlinedleast in this procedure.

        privilege.
      • Writing
        access control information outside of a secure, university-approved password management solution.

      9.13. CharterStandards Review

      This charterdocument will be reviewed and reaffirmed annually, or upon significant changes to university IT governance, systems, or regulatory requirements.

      Effective Date: SeptemberJuly 1, 2025
      Next Review Date: SeptemberJuly 22,1, 20252027
      Version: 3.32.0

      AppendixReferenced IPolicies, –Standards, Glossaryand Procedures

      • Account:Technology AnyResource combinationManagement ofStandard
        • a
      • Data user IDSecurity and aClassification passphrase that grants an authorized user access to a computer, an application, the network, or any other information technology resource.Policy
      • StandardArkansas UserState University Data Retention Procedure
      • Logical Access Account: AnManagement accountProcedure
        • with
      • Logical noAccess administrativePassword access to both domain-levelEnforcement and endpoint-levelMonitoring information systems.
      • Domain-Level System Administrator: A system administrator with elevated responsibilities tasked with managing core infrastructure systems, including servers, Active Directory, network configurations, and other resources with organization-wide impact.

      • Endpoint-Level System Administrator: A system administrator with responsibilities for direct endpoint management. This includes software installation, endpoint imaging, basic troubleshooting, and hands-on user support.

      • Endpoint: A computing device that is used directly by an end user.

      • End User: An authorized user who directly interacts with and uses information systems, applications, or services to perform their job functions. While reliant on information systems, they are restricted from managing or configuring said systems.

      • Service Account: An information system account created for the purpose of facilitating automated processes, system integrations, or background services that operate without direct user interaction. These accounts are typically used for tasks such as data synchronization, system monitoring, and application communication, and are not tied to individual user activities.

      • CJIS: Criminal Justice Information Services.

      • CJIS User Account: An information system account with either direct or indirect access to Criminal Justice Information Services data.

      • Controlled Unclassified Information (CUI): Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

      • Domain Administrator Account: A highly privileged information system account with elevated access to organizational information systems.

      • Local User Account: A non-administrative account that is only available on a local endpoint. This account is not present within account management services such as Active Directory.

      • Local Administrator Account: An administrative account that is only available on a local endpoint. This account is not present within account management services such as Active Directory.

      • Default Administrator Account: A pre-configured account on an endpoint or system that possesses the highest level of access and permissions. This account is managed by an account management service such as Active Directory.

      • Active Directory: Stores information about user accounts, such as names, passphrases, phone numbers in a maintainable and referenceable way.

      • CrowdStrike: A cybersecurity company that offers a wide range of products and services to help organizations protect their data and systems from cyber threats.

      • Information System: A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

      • System Administrator: An authorized technical professional responsible for the implementation, management, maintenance, and security of information systems. System administrators enforce organizational policies, apply standard procedures, and ensure the confidentiality, integrity, and availability of technology resources across both domain-level and endpoint-level environments.

        Procedure

       

       

      Back to top