Oregon Administrative Rules
Chapter 291 - DEPARTMENT OF CORRECTIONS
Division 5 - NETWORK INFORMATION SYSTEM ACCESS AND SECURITY
Section 291-005-0035 - Termination of Access

(1) Notice of termination of employment with the agency shall result in retirement of the individual's user account(s). Prompt notice of termination shall be sent to the Department of Corrections ISO or designee by the Employee Services manager or designee who handles user authorization. This procedure also applies to users from external organizations, Oregon Corrections Enterprises, contractors, and volunteers.

(2) Functional unit managers or their designees shall review a list of user accounts from their respective units annually to ensure accounts are legitimate. Information Technology Services (ITS) shall provide the list.

(3) Managers of external users shall review a list of users annually and confirm those needing continued access. ITS shall provide the list.

(4) Newly created user profiles that are not used within 45 days will be removed.

(5) User profiles for deceased employees shall be immediately disabled upon notification. Notification is provided to manager and site contact. If no response is received from the manager or site contact within 14 days, the profile will be deleted.

(6) Users and managers of existing profiles that are inactive for a period of 45 days will be sent notification by the Department of Corrections ISO or designee to confirm continued need for access. If there is no response within 10 business days, the profile will be disabled. Disabled accounts will be deleted 30 days after disablement, unless otherwise noted on the account.