# Access Agreement
**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
| Organization | Agreement version | Effective date | Owner |
| --- | --- | --- | --- |
| [Organization name] | [Fill in: version] | [Fill in: date] | [Chief Information Security Officer] |
## About this agreement
Everyone who needs access to [Organization name]'s information or systems signs this agreement before access is granted, including employees, contractors and partners (PS-6c.1). You sign it again when it is updated, and [Fill in: the frequency at which to re-sign access agreements to maintain access to organizational information. Typical: annually], to keep your access (PS-6c.2). If you do not re-sign an updated agreement, your access is suspended until you do.
This agreement adds to the Rules of Behavior, which you also sign. Where the two differ, the stricter one applies.
## Terms
### Authorized use
1. I will use [Organization name]'s information and systems only for the purposes I am authorized for, and only as my role requires.
2. I will not try to gain access to information or systems I am not authorized to use, or help anyone else do so.
3. I will follow the Rules of Behavior and the organization's security and privacy policies.
### Nondisclosure
1. I will not disclose nonpublic information of [Organization name], or information entrusted to it by others, to anyone who is not authorized to receive it.
2. I will protect such information according to its marking or sensitivity, in any form and wherever I work.
3. My duty not to disclose this information continues after my access ends, for as long as the information stays nonpublic, unless a law or a written agreement says otherwise.
### Personal information
1. I will access personally identifiable information only when my work requires it, and use it only for the purpose it was collected for.
2. I will report any loss, misuse or unauthorized disclosure of personally identifiable information as soon as I know of it.
### Monitoring
1. I understand that [Organization name] monitors and records the use of its systems, as the system use notice says (AC-8), and that I have no expectation of privacy in what I do on them, except where a law provides otherwise.
2. I understand that monitoring records may be reviewed and used in investigations and disciplinary action.
### Reporting
1. I will report suspected security incidents, privacy breaches and violations of this agreement to [Fill in: where to report, for example the service desk or the security team] as soon as I know of them.
### When my access ends
1. When I leave [Organization name] or no longer need access, I will return all organizational property, including devices, authentication tokens, keys, identification cards, building passes, and information in any form (PS-4d).
2. I will take part in an exit interview if asked, which will cover [Fill in: information security topics to be discussed when conducting exit interviews. Typical: the individual's continuing duty not to disclose organizational information, the return of all organizational property and information, and that former credentials must not be used] (PS-4c).
3. I will not use any credential or access I held after it has ended.
### Conflict of interest
1. I will tell [Fill in: who, for example my supervisor or the ethics office] about any interest or relationship that conflicts, or could appear to conflict, with my access or duties.
### Consequences
1. I understand that breaking this agreement may lead to loss of access and to action under the organization's sanctions process (PS-8), and that some breaches may also be unlawful.
## Additional terms for privileged users
Complete this section only for a person who is given privileged access, such as a system administrator.
1. I will use privileged accounts only for tasks that need them, and use my regular account for everything else (AC-6(2)).
2. I will not use privileged access to look at information I have no business need to see, or to change audit records or security settings without authorization.
3. I will record privileged changes through the organization's change management process (CM-3).
## Acknowledgment
I have read, understand and agree to follow this agreement and the Rules of Behavior (PS-6).
| Name | Organization or employer | Role | Privileged user (yes or no) | Signature | Date |
| --- | --- | --- | --- | --- | --- |
| [Fill in: name] | [Fill in: organization] | [Fill in: role] | [Fill in: yes or no] | [Fill in: signature] | [Fill in: date] |
## Maintaining this agreement
- The [Chief Information Security Officer] owns this agreement and documents it for the organization's systems (PS-6a).
- The [Chief Information Security Officer] reviews and updates this agreement [Fill in: the frequency at which to review and update access agreements. Typical: annually] (PS-6b).
- The account manager checks for a signed agreement before granting access, and for a new signature after each update (PS-6c).
- Signed agreements are kept [Fill in: where, for example in the personnel file or the identity governance system] for [Fill in: how long, for example until 3 years after access ends].
## Register
| Name | Organizational unit or employer | Role | Agreement version | Privileged terms | Date signed | Access granted | Re-sign due | Where the signed copy is kept |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: name] | [Fill in: unit or employer] | [Fill in: role] | [Fill in: version] | [Fill in: yes or no] | [Fill in: date] | [Fill in: date] | [Fill in: date] | [Fill in: location] |