The Official Web site for the Office of Information Technology - UTSA

Purpose - The UTSA Administrative/Special Access Security Standard establishes the rules for the creation, use, monitoring, control and removal of accounts with special access privileges for the maintenance of information resources. Administrative access to individual workstations is prohibited unless approved by the Information Resources Manager (IRM).

Audience - The UTSA Administrative/Special Access Standard applies equally to all individuals that have, or may require, special access privilege to any UTSA information resources.

1. All users must sign the UTSA Information Resources Security Acknowledgement and Nondisclosure Agreement before access is granted.

2. All users of Administrative/Special Access accounts must be provided with account management instructions, documentation, training and authorization.

3. Each individual who uses an Administrative/Special Access account must refrain from abuse of this privilege. Periodic random audits will be conducted to ensure proper use of the account.

4. Each individual who uses an Administrative/Special access account must use the account most appropriate for the work being performed (i.e., user account vs. administrator account).

5. Each account password must meet the UTSA Password Standard.

6. The password for a shared administrator/special access account must be changed when a password holder leaves the department or UTSA, or upon a personnel change of the vendor assigned to a UTSA contract.

7. If the system has only one administrator, there must be a password escrow procedure in place so someone other than the administrator can gain access to the administrator account in an emergency situation. The procedure will be audited on a regular basis.

8. When Special Access accounts are needed for audit, software development, software installation or other defined need, they:

   1. must be authorized by the system owner, IRM or Information Security Officer (ISO)

   2. must be created with a specific expiration date

   3. must be removed when work is complete.

9. The use of privileged commands must be traceable to specific individuals via the use of comprehensive logs.