Enrolment Objective Deliver a defined, fit-for-purpose and efficient identity onboarding and matching capability to ensure accurate and authorised access to ICT systems and resources. Reference Direction Purpose EN-01 Staff On-boarding A trusted, governed, managed and easy-to-use online capability for staff access requests to ICT systems and resources. Automated, repeatable, robust, efficient and effective implementation of business process. Improved turn-around of access requests. Assurance that the right people have the right access to the right systems at the right time. Reduced number of data breaches due to mature and robust on-boarding approval processes and timely off-boarding. EN-02 Staff On-boarding The Strategic HR (HCM) system, or department equivalent system, to become the authoritative source of staff identities for on-boarding and provider of a unique, persistent HR employee identifier. HR system to become the authoritative source for employees, contractors, casuals and volunteers*. Accurate, timely and authoritative granting and removal of access to ICT systems and resources. Consistent provisioning based on robust, compliant, repeatable processes. Unique, persistent employee identifier provided by HR for association with the VGID. * This will have business process and cost implications for People and Culture (HR) that requires further consultation and evaluation as part of the IdAM strategy, solution design and implementation. EN-03 Identity Matching HR will manage and perform the identity matching function. Short-Term: maintain status quo - staff identity matching capability provided by WoVG IdAM and performed in the line of business (e.g. by line managers, champions, EAs) Medium-Term: staff identity matching capability provided by WoVG IdAM but function is performed by HR Long-Term: staff identity matching capability provided by strategic HR platform and performed by HR. Identity verification performed by responsible and authoritative area with access to all the necessary identity information to perform the match e.g. Date of birth. Facilitates workforce tracking. Facilitates improved alignment between employee screening, ICT access compliance requirements and determination of a level of identity assurance for workforce users. EN-04 Identity Matching A common flexible staff identity matching capability that allows matching during or post configurable nominated responsible officer(s) Low impact identity reconciliation function to facilitate streamlined enrolment. Enable responsible officers to have choice when identity matching is performed. Nominated responsible party is configurable to support transition of identity matching function to HR over time. Improved data quality and identity reconciliation outcomes.
EN-05 Business Partner & Service Provider On-boarding A trusted, governed, managed and easy-to-use online capability for business partner and service provider access requests to ICT systems and resources. Automated, repeatable, robust, efficient and effective implementation of business process. Improved turn-around of access requests. Assurance that the right people have the right access to the right systems at the right time. Reduced number of data breaches due to mature and robust on-boarding approval processes and timely off-boarding. EN-06 Delegated Admin A delegated administration capability to support business partner and service provider Enable external organisations to locally manage and authorise access requests. Further improved turn-around of access requests. Reduced administration burden for departments. EN-08 Access Control (RBAC) Provisioning Establish access based on position titles, attributes roles, etc (RBAC/ABAC) Low maintenance, consistent, repeatable and accurate enrolment to ICT systems and resources on role rather than the individual. Initial access is aligned with the authoritative source (HR). EN-09 Automated workflow approval A common approval workflow capability that facilitates Line Manager approval determination of a level of identity assurance identity assurance step-up escalation management Low maintenance, consistent, repeatable and robust user provisioning practices. Instantiation of an identity trust framework to support secure federated identity across departments and external identity providers. Ability to increase level of assurance of an identity (step-up) for access to more sensitive ICT systems and information. Robust approval processes with follow up for process closure. EN-10 Other A fit-for-purpose administration interface to manage workforce access, run reports and troubleshoot issues. Customised to meet administrator needs. Reports to facilitate data cleansing activities. Ability to override workflow constraints and issues with approval. Reduced demand on IdAM technical specialists to resolve operational problems. Lifecycle Management Objective Deliver common, fit-for-purpose and efficient identity lifecycle management and provisioning of access to ICT systems and resources. Reference Direction Purpose LM-01 Staff Changes & Exits A trusted, governed and managed online lifecycle management capability for changing and revoking staff access to department ICT systems and resources. Automated, repeatable, robust, efficient and effective implementation of business process. Improved turn-around of access changes and revocation. Assurance that the right people have the right access to the right systems at the right time. Reduced number of data breaches due to mature and robust on-boarding approval processes and timely
Application accounts e.g. WebAPI Device accounts. Reference Direction Purpose PA-01 Policies & Standards Policies, standards, and frameworks for privileged identity and access management Facilitate compliance with federal and state government standards and practices e.g. Victorian Protective Data Security Standards (VPDSS), Information Security Manual (ISM). Consistent, secure privileged access management across departments based on least privilege, segregation of duties and just-in-time control. Common, more secure SDLC account practices. Managed and secured service accounts. Streamlined policy development and maintenance, once across departments. PA-02 Secure Enrolment Common, secure online enrolment for approval and creation of privileged access Enforced strong verification processes aligned with NeAF identity verification standards e.g. police checks, employment history checks, for improved assurance. Robust and enforced approval processes. privilege for reduced risk of compromise of sensitive information and critical business systems. PA-03 Secure Lifecycle Management Common, secure online lifecycle management for maintaining and revoking privileged access Robust and enforced strong approval processes for improved assurance. Reduction in orphan privileged accounts for reduced risk of compromise to sensitive information and critical business systems. Least-privilege entitlement approach for reduced risk of compromise to sensitive information and critical business systems. Allow IT administrator access without exposing administrator passwords or root-account credentials PA-04 Secure Access Control Multi-factor authentication services and step-up facility for privileged accounts e.g. SMS, biometrics Improved security at time of use of privileged account for reduced risk of compromise of sensitive information and critical systems. Authentication on agreed risk profiles. Expensive, complex technologies procured and invested in once. Manage, control and record privileged account activities for all authenticated systems across physical and virtual environments. PA-05 Just in Time usage Tools for enforcement of use of privileged accounts Time restricted use of privileged access for reduced risk of compromise to sensitive information and business critical systems. Enforced segregation of duties. Expensive, complex technology procured and invested in once. Robust tracking of privileged access use. PA-06 Strong Assurance Operational Reporting capability Improved visibility of privileged access abuse to reduce risk of compromise to sensitive information and critical business systems Low maintenance Provide assurance on privileged access Facilitate improved compliance Support audit activities Facilitate improved data quality.
Implementation Planning will commence with the development of a Victorian Government Workforce IdAM strategy and implementation plan that will align with the Victorian Government Information Technology Strategy 2016 to 2020 and the broad principles of governance and implementation set out in the Business Support Services Strategic Review. To progress this, DPC will establish a working group of stakeholders to assist with the development of a business case for seed funding to perform a maturity assessment and develop the strategy and detailed implementation plan. Approach Reference Direction Purpose AP-01 Roadmap of IdAM Capabilities Provide high level timeline for delivery of IdAM capabilities. To follow completed IdAM Statement of Direction. AP-02 Business case for procurement of services to develop the Workforce IdAM Strategy and Implementation Plan Request for seed funding. Independent, expert guidance on identity and access management. Provide the necessary resources to gather all departments and CenITex requirements. Obtain the necessary skills and expertise to perform a maturity assessment across departments to determine elements for re-use. AP-03 The Victorian Government will have a Workforce IdAM Strategy Defines the future state based on good practice and federal, state and industry standards. on maturity assessment of current department and CenITex IdAM capability. Is aligned with department and CenITex strategic IdAM directions. Deliverables based on department priorities. Designed to be usable by all in-scope departments. AP-04 The Victorian Government will have a Workforce IdAM Implementation Plan 5 year implementation plan with detail of next 2 years and key priorities for subsequent years. Based on department priorities. Includes all in-scope departments. Incorporates planned department and CenITex programs of work.