All third party organizations and individuals that require access to non-public electronic data and resources maintained by CCA and who are not otherwise classified as full time, part time, or temporary faculty, staff, or students fall under this policy.

CCA Sponsor

All third parties with a CCA account must be sponsored by a CCA department, organization, or employee.

The sponsor must submit a request for access for the third party using the Contract/Contingent Employee process in Workday.

Access to sensitive data should be approved by the responsible data steward and documented in the request form.

Account Holders

All persons, whether a part of a third party organization or individual contractor, will only be given access to services required to perform their work with the appropriate level of access.

All account holders must provide external contact information that will be used to contact the account holder in the event of account status changes, misuse, or termination of the contracting agreement.

All account holders must agree to the CCA Acceptable Use Policy, as well as the Data Security and Confidentiality Agreement.

Modifying or Changing Access

All changes to access granted under this policy must originate from the CCA Sponsor and are subject to a security review, including the addition or removal of individual accounts for persons within a third party organization.

Terminating Access

When requesting access using the Contract/Contingent Employee process, a contract end date is required. On the day after this date, the contractor’s CCA account will be disabled. This date can be changed at any time.

It is the responsibility of the CCA Sponsor to ensure that an accurate end date is provided for every Contractor with a CCA account.

CCA may determine an early termination, should there be a cybersecurity threat detected due to compromised systems or accounts managed by the contractor. The Contractor must notify CCA Help Desk if any such event should take place in the duration of the contract with CCA.

Enforcement

Any account holder that is found to have violated this policy will have the account suspended and the account holder's CCA Sponsor will be notified. Following a review, Tech Services will implement the actions specified by the CCA Sponsor to reinstate or remove the account.