The central security administration team at SBCTC will undertake the following duties:

• Creation of local service accounts.
• Maintenance of a standard naming convention for accounts, e.g., JOBS_WAXXX, JOBS_WAXXX_2.
• Work with the Functional ERP Support teams to review the access to ensure compliance and reduce risk.
• Updating role assignments associated with service accounts.
• Auditing role assignments to ensure they are current and appropriate.
• Performing biannual recertification of service account roles and access.

Each institution is advised to limit the number of service accounts to two, unless they are using it for Core, Financial Aid and Student Financials, then the max is three accounts.  Each account must have ONE Primary owner, who understands the processes that are running within the account and can oversee job failures.  This person must be trained in their area, especially in the Financial Aid realm.  It is critical to have a trained person to ensure there isn’t a full system impact if jobs fail.  Also, the local Security Administrator at that campus MUST be involved and review the access so that they are aware of What is being ran and can assist in Audits.  The PRIMARY person responsible for this account will be responsible for the following:

• Overseeing the operational control of the account post-establishment, including password management and auditing account usage. In the case where the primary owner is out and someone has to intervene on the job account to fix errors, the password should be reset when the primary owner returns.  It is Best Practice to request these passwords be changed every 90 days as they are considered privileged type accounts.  The Primary owner should be the only one to know the password, and relay that password to a backup if they are out on vacation and the jobs fail.  IN instances where the primary owner is not available, the local security administrator can submit a high priority ticket to SBCTC and request a password reset be sent to the email on that account.
• Submitting requests for service accounts through the SBCTC Service Desk (https://servicedesk.sbctc.edu) with the necessary details outlined below.
• Complying with biannual recertification requests initiated by SBCTC.
• Colleges should NEVER alter role access and SACR for these service accounts.
• Once the account is activated, the primary owner of the account can use the Reset Password functionality to reset the password. The reset link will go to the Email ID that is on the service account. If it is a group email address, it will be sent to the group, and one of the members (the primary) can log in and reset it.  If it is an individual's email address it will go to that person's email, and they can reset it.  If the primary member is out, and it's NOT a group email, then it is a ticket to  SBCTC.                            

The primary owner in conjunction with the Local Security Administrator must provide the following information when submitting service account creation requests (https://servicedesk.sbctc.edu):

• Detailed description of the intended use for the service account.
• Provide a list of Processes that will be run by the Service accounts and include the navigations.  
• Required access levels and roles (specify Roles/SACR) that are needed for the processes if known.
• Name and contact information of the Primary Owner and the Security Administrator accountable for the service account.
• The procedure for monitoring service account usage, including password management protocols.
• Preferred email address to be associated with the account for notification purposes.

Please ensure all requests and communications adhere to these guidelines to maintain system integrity and operational continuity.