Adapt this template. It is not an ADEK policy, and completing it does not by itself meet a regulatory requirement. Replace every placeholder in brackets and keep a version date.
Access
- The line manager requests access in writing, naming the system and the reason.
- IT grants the minimum role.
- On exit, HR tells IT before the last day. IT disables accounts the same day and notes the time.
Backup test
Once a term, restore one real file from backup to a separate location and record whether it opened. A successful schedule email is not a test.
Incident
If data is exposed, isolate the account, write down what was visible and to whom, and tell the principal the same day. Do not message the whole staff with the personal details.