# Access Request Form

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/access-request-form/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| System | Request ID | Request type | Date submitted | Status |
| --- | --- | --- | --- | --- |
| [Fill in: system name and identifier] | [Fill in: unique request ID] | [Fill in: new account, added access, change of access, or temporary account] | [Fill in: date] | [Fill in: submitted, approved, rejected, provisioned or closed] |

## 1. How to use this form

- The requester completes Parts A and B. A supervisor may request for a person they supervise.
- The [Account manager] completes Parts C and D before the request goes for approval.
- The approvers complete Part E. Group and role membership needs [Fill in: prerequisites and criteria for group and role membership. Typical: a completed access request, a signed access agreement and completed security awareness training] (AC-2c), and account creation needs approval by [Fill in: personnel or roles required to approve requests to create accounts. Typical: the user's supervisor, plus the system owner or data owner for privileged roles] (AC-2e). No one approves a request for their own access.
- The [Account manager] provisions only what Part E approves, completes Part F, and enters the request in the register.
- To remove access, use the [onboarding, transfer and termination checklist](https://kston83.github.io/nist-guide/templates/forms/onboarding-transfer-and-termination-checklist/) or a notice under section 5.5 of the account management procedure, not this form.

## Part A. User

| Field | Entry |
| --- | --- |
| Name | [Fill in: full name] |
| Unique identifier | [Fill in: employee or contractor number, or existing user ID] |
| Organization or employer | [Fill in: organizational unit, or the company for a contractor] |
| Position | [Fill in: job title] |
| Supervisor | [Fill in: name and contact] |
| Requested by, if not the user | [Fill in: name and role] |

## Part B. Access requested

| Field | Entry |
| --- | --- |
| Account type | [Fill in: individual, privileged, service, temporary, or other type the system allows] |
| Roles or groups requested | [Fill in: role or group names, as the system defines them] |
| Business need | [Fill in: the duties that need this access] |
| Information accessed | [Fill in: types of information, and whether it includes personally identifiable information] |
| Start date | [Fill in: date] |
| End date | [Fill in: for a temporary account or a fixed-term role, the date access ends; otherwise none] |
| Other attributes | [Fill in: restrictions to apply, from the attributes the account management procedure records for each account] |
| Remote access needed | [Fill in: no; or yes, and the approved method from the remote access standard] |

The account record holds the authorized user, group and role membership, access authorizations and [Fill in: attributes (as required) for each account. Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them] (AC-2d). A temporary account is set to be disabled automatically at its end date, and an emergency account after [Fill in: the time period after which to automatically remove or disable temporary or emergency accounts. Typical: 72 hours for emergency accounts, and the end date approved at creation for temporary accounts] (AC-2(2)).

For a privileged account, the user also keeps a separate non-privileged account for email, web browsing and other nonsecurity functions (AC-6(2)). Name it here: [Fill in: non-privileged account ID].

## Part C. Prerequisites

| Prerequisite | Met? | Evidence |
| --- | --- | --- |
| Screening required for the position completed (PS-3) | [Fill in: yes or no] | [Fill in: date, from the personnel security office] |
| Access agreement signed (PS-6) | [Fill in: yes or no] | [Fill in: date, from the access agreement register] |
| Rules of Behavior acknowledged (PL-4) | [Fill in: yes or no] | [Fill in: date] |
| Security and privacy awareness training completed (AT-2) | [Fill in: yes or no] | [Fill in: date, from the training record log] |
| Role-based training, for a privileged or specialist role (AT-3) | [Fill in: yes, no, or not needed] | [Fill in: date] |
| Other prerequisites for this system or role | [Fill in: yes, no, or none] | [Fill in: evidence] |

| Checked by | Date |
| --- | --- |
| [Fill in: account manager name] | [Fill in: date] |

## Part D. Separation of duties check

| Question | Answer |
| --- | --- |
| Does the user already hold a role that conflicts with one requested, under section 4 of the account management procedure? | [Fill in: no; or yes, with the conflict] |
| If yes: how it was resolved | [Fill in: role removed, request changed, or exception approved by the system owner with compensating review] |
| Checked by and date | [Fill in: account manager name and date] |

## Part E. Approvals

| Approver | Role | Decision | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Supervisor] | [Fill in: approved or rejected, with any roles removed] | [Fill in: date] |
| [Fill in: name] | [Fill in: system owner or data owner, for privileged roles or sensitive information] | [Fill in: approved or rejected] | [Fill in: date] |
| [Fill in: name] | [Fill in: other approver the system requires, or not applicable] | [Fill in: approved or rejected] | [Fill in: date] |

## Part F. Provisioning

| Field | Entry |
| --- | --- |
| Account identifier | [Fill in: user ID or account name] |
| Roles and groups granted | [Fill in: as approved in Part E] |
| Attributes set | [Fill in: end date and restrictions applied] |
| Created or changed by | [Fill in: account manager name] |
| Date and time | [Fill in: date and time, which is after every approval in Part E] |
| Initial authenticator issued | [Fill in: how and when, or not applicable] |
| User notified | [Fill in: date] |

## Register

| Request ID | User | System | Type | Roles requested | Prerequisites checked (date) | Conflict found | Approved by and date | Provisioned by and date | End date | Closed |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: name or ID] | [Fill in: system] | [Fill in: request type] | [Fill in: roles] | [Fill in: date] | [Fill in: no; or yes and resolution] | [Fill in: names and dates] | [Fill in: name and date] | [Fill in: date or none] | [Fill in: date] |