[CAFR-Contacts-News] FW: Updated OAM 10.70.00 out for comment

[HAMILTON Robert W * DAS]

Hello CAFR Contacts,

Based on comments we received related to paragraph 109 of the exposed draft of OAM 10.70.00, we've greatly enhanced that specific paragraph, and as a result, we're re-exposing this OAM to comment.  In this scenario, the comment period will be one week, closing at the end of the day on Thursday, April 6.

In the OAM exposed previously, paragraph 109 stated "ASOs must notify the Chief Financial Office, Systems Security team via email at security.systems at oregon.gov<mailto:security.systems at oregon.gov> to modify or revoke a user's access within 24 hours of a position change." This was largely a continuation of paragraph 104 of the currently effective OAM.

In the re-exposed OAM, paragraph 109 now states:

Upon the complete fulfillment of a personnel action -- related to the departure or position change of an employee -- within PPDB, the employee's access to the systems covered by this OAM are automatically revoked in an overnight process. However, if the agency determines that an employee's access needs to be modified or revoked, and it will not result in the immediate and complete fulfillment of a personnel action as described above, the agency must notify the ASO within three business days of that determination. In turn, the ASO will have one business day, starting from their notification from the agency, to notify the Systems Security team via email at security.systems at oregon.gov<mailto:security.systems at oregon.gov> to modify or revoke the employee's access, as applicable.
Each agency is responsible for developing procedures to notify their ASO timely of a need to revoke a user's access that is not related to the immediate and complete fulfillment of a personnel action as described above.
We feel this adds more context to the requirement and clarifies the responsibilities of the agency and the ASO.

The entire re-exposed OAM can be found here: http://www.oregon.gov/das/Financial/Acctng/Documents/10.70.00%20Security%20Access%20-%20comments.pdf

Please direct any comments to me.

Thank you,

Rob

From: CAFR-Contacts-News [mailto:cafr-contacts-news-bounces at listsmart.osl.state.or.us] On Behalf Of HAMILTON Robert W * DAS
Sent: Tuesday, February 21, 2017 2:39 PM
To: cafr-contacts-news at listsmart.osl.state.or.us
Subject: [CAFR-Contacts-News] Updated OAM 10.70.00 out for comment

Hello CAFR Contacts,

An update to OAM 10.70.00, Internal Control: Security Access to Central Financial Systems has placed out to comment.  http://www.oregon.gov/das/Financial/Acctng/Documents/10.70.00%20Security%20Access%20-%20comments.pdf

This updated OAM reflects the SARS decision to merge the previously separate PO and PR OAMs to a single OAM.  Other changes include:


*         Updating division and unit titles to current

*         Updating security form titles to current

*         Minor verbiage changes to add clarity

Due to the merger of 10.70.00 PO and 10.70.00 PR, a track changes version is not available.

The comment period for this OAM ends at close of business on Friday, March 3.  Please direct any comments to me.

Thank you,

Rob

Robert W. Hamilton, CPA
Statewide Accounting and Reporting Services Manager
Chief Financial Office
Department of Administrative Services
Phone:  (503) 373-0299
http://www.oregon.gov/DAS/financial/acctng

Data Classification: Level 1 - Published

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://omls.oregon.gov/pipermail/cafr-contacts-news/attachments/20170330/028c4471/attachment.html>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ATT00002.txt
URL: <https://omls.oregon.gov/pipermail/cafr-contacts-news/attachments/20170330/028c4471/attachment.txt>