Outlines factors that need to be considered when involved in identity management and the managing electronic identities of departmental employees, students and other users of the departmental network and/or systems; and implementing appropriate identity management access to ICTs.
Statement of intent
The Department encourages access to its information resources, provided security measures are in place to limit access to restricted (confidential, protected and highly protected) information to only authorised persons.
The Department will provide secure access to information in departmental ICT systems to authorised users through provision of electronic identities. Electronic identities may be provided to:
- All correctly enrolled students
- All staff members and contractors who are identified and appropriately authorised
- All responsible adults who request an electronic identity and who have been appropriately identified, and who have one or more students enrolled in a state school
- All external persons who have a legitimate role with the department
- All external organisations who have a legitimate role with the department
Users will only be provided access to information required to meet their needs as authorised by ICT systems owners.
Access to restricted information is only to be provided to users to perform their functions as outlined in their position statement and will be monitored using access controls and logging.
The required level of access control to information is determined by its security classification. These requirements are detailed in IFM-PR-003: Classification and Handling of Information Assets.
Electronic identities will be:
- Managed through their complete lifecycle from registration, through propagation and maintenance, to deactivation.
- Registered and logged in accordance with the registration framework, departmental policies and legislative requirements to enable audits to be undertaken.
- Will be maintained as a central store, but copies of these identities may also be stored in other locations as required.
- Managed to ensure consistency and accuracy of identity data. Authorised users will be able to review and update defined attributes of electronic identities. Changes to an electronic identity will be logged and monitored.
- Deactivated as required and all deactivations of electronic identities will be logged in accordance with departmental policies and legislative requirements.
Please refer to the Managing Electronic Identities and Identity Management Guidelines for further information in relation to identity registration, authentication, account review and management, third party access, logging and auditing, and privacy.
Student and staff safety will be maintained by ensuring personal and sensitive information is not accessed by unauthorised users.
Access to personal information is to comply with Information Standard 42 (IS42): Information Privacy. new window and departmental policy.
Contacts
For information about managing electronic identities, contact:
Other languages