SharePoint Security - ARB SEcurity Solutions
Site Blog Home About ARBBlog SharePoint Dev Center Security Labs Contact
SharePoint Security Policy Templates : SharePoint Portal Administrator / Consultant Access Policy Template
Introduction - SharePoint Administrative / Special Access Privacy Policy Technical support staff, SharePoint Administrators, security administrators, system administrators, SharePoint consultants, and others may have special access account privilege requirements compared to typical or everyday users. The fact that these administrative and special access accounts have a higher level of access means that granting, controlling and monitoring these accounts is extremely important to an overall SharePoint security program.
Purpose The purpose of the [SharePoint Portal Owning Organization] Administrative/Special Access Practice Standard is to establish the rules for the creation, use, monitoring, control and removal of SharePoint accounts with special access privileges.
Audience The [SharePoint Portal Owning Organization] Administrative/Special Access Practice Standard applies equally to all individuals that have, or may require, special access privilege to any [SharePoint Portal Owning Organization] SharePoint resources.
SharePoint Administrative / Special Access Policy
  • [SharePoint Portal Owning Organization] departments must submit to [SharePoint Portal Owning Organization] SharePoint sponsors a list of administrative contacts for their systems that are connected to the [SharePoint Portal Owning Organization] SharePoint enviroment.
  • All SharePoint users must sign the [SharePoint Portal Owning Organization] Security Acknowledgement and Nondisclosure Agreement before access is given to an account.
  • All SharePoint users of Administrative/Special access accounts must have account management instructions, documentation, training, and authorization.
  • Each SharePoint user that uses Administrative/Special access accounts must refrain from abuse of privilege and must only do investigations under the direction of [SharePoint Portal Owning Organization] management.
  • Each SharePoint user that uses Administrative/Special access accounts must use the account privilege most appropriate with work being performed.
  • Each SharePoint account used for administrative/special access must meet the [SharePoint Portal Owning Organization] SharePoint Password Policy.
  • The password for a shared administrator/special access account must change when an individual with the password leaves the department or [SharePoint Portal Owning Organization], or upon a change in the vendor personnel assigned to the [SharePoint Portal Owning Organization] contract.
    In the case where a system has only one SharePoint administrator there must be a password escrow procedure in place so that someone other than the SharePoint administrator can gain access to the SharePoint administrator account in an emergency situation.
  • When SharePoint Special Access accounts are needed for Internal or External Audit, software development, software installation, or other defined need, they:
  1. must be authorized
  2. must be created with a specific expiration date
  3. must be removed when work is complete
Administrative / Special Access Policy Supporting Information
  • Any and all [SharePoint Portal Owning Organization] SharePoint security controls must not be bypassed or disabled.
  • SharePoint Security awareness by [SharePoint Portal Owning Organization] personnel must be continually emphasized, reinforced, updated and validated.
  • All [SharePoint Portal Owning Organization] SharePoint users are responsible for managing their use of SharePoint and are accountable for their actions relating to SharePoint security. Users are also equally responsible for reporting any suspected or confirmed violations of this policy to the appropriate management responsible for SharePoint security incident handling.
  • User SharePoint account passwords shall be protected by the individual user from use by, or disclosure to, any other individual or organization. All security violations shall be reported to respectful SharePoint security incident handling management.
  • Access to, change to, and use of SharePoint Account Management Policy must be strictly secured. SharePoint information access authority for each user must be reviewed on a regular basis, as well as each job status change such as: a transfer, promotion, demotion, or termination of service.
  • The use of SharePoint must be for officially authorized business purposes only. There is no guarantee of personal privacy or access to tools such as, but not limited to; SharePoint areas, WSS team sites, any and all collaboration and communication functionality, and any sister sever integrations (i.e. integrated Microsoft Exchange environments). The use of Sharepoint and SharePoint related tools may be monitored to fulfill complaint or investigation requirements, including forensic an analysis into IDS or other security systems. Departments responsible for custody and operations of the SharePoint servers (custodian departments) shall be responsible for proper authorization of SharePoint server utilization, the establishment of effective use, and reporting of performance to management.
  • Any data housed within SharePoint must be kept confidential and secure by the respectful [SharePoint Portal Owning Organization] SharePoint user. The fact that the business data may be stored electronically (i.e. document library or SharePoint list) does not change the requirement to keep the information confidential and secure. The type of information or the information itself is the basis for determining whether the data must be kept confidential and secure. Furthermore if this data is stored in a paper or electronic format, or if the data is copied, printed, or electronically transmitted the data must still be protected as confidential and secured.
  • On termination of the relationship with the Sharepoint user all security policies for [SharePoint Portal Owning Organization] apply and remain in force surviving the terminated relationship.
  • [SharePoint Portal Owning Organization] server custodian departments must provide adequate access controls in order to monitor SharePoint systems to protect business data and associated programs from misuse in accordance with the needs defined by owner departments. All SharePoint access must be properly documented, authorized and controlled, following [SharePoint Portal Owning Organization] standardized processes.
  • All [SharePoint Portal Owning Organization] departments must carefully assess the risk of unauthorized alteration, unauthorized disclosure, or loss of the data within the [SharePoint Portal Owning Organization] SharePoint environment for which they are responsible and ensure, through the use of monitoring mechanisms such that [SharePoint Portal Owning Organization] is protected from damage, monetary or otherwise. SharePoint owners and server custodian departments must have appropriate backup and contingency plans for disaster recovery based on risk assessment and business requirements.
Disciplinary Actions Violation of this policy may result in disciplinary action which may include termination for employees and temporaries; a termination of employment relations in the case of contractors or consultants; dismissal for interns and volunteers; or suspension or expulsion in the case of a student. Additionally, individuals are subject to loss of [SharePoint Portal Owning Organization] SharePoint access privileges, civil, and criminal prosecution.
Compliance / Regulation Contributed to by this Policy
  • Copyright Act of 1976
  • Foreign Corrupt Practices Act of 1977
  • Computer Fraud and Abuse Act of 1986
  • Computer Security Act of 1987
  • The Health Insurance Portability and Accountability Act of 1996 (HIPAA)


Any Templates Provided On This Site Are Provided Without Warranty Or Implication. To Brand The Template(s) Replace The [SharePoint Portal Server Owning Organization] With Your Company Name


 
 Security Policy Info

Index of SharePoint Security Policy Templates

Most Downloaded SharePoint Security Policy Templates:
SharePoint Portal Server Acceptable Use Policy Template

 Global Policy Options

Defining SharePoint Security Policy Standards


SharePoint Security Policy Check List


Change Management For SharePoint Security Policies (text)


Change Management For SharePoint Security Policies (diagram)

© 2006 ARB Security Solutions, LLC
ARB Security Solutions is not affiliated with or endorsed by Microsoft Corporation.
SharePoint is a trademark of Microsoft Corporation.     Legal Notices | Privacy 		SharePointSecurityFooter