Access Request Form template: The record of one request to create an account or change a person's access to a system, with the prerequisite checks, separation of duties check, approvals and provisioning, and a register of every request, as SP 800-53 AC-2 requires.
The record of one request to create an account or change a person’s access to a system, with the prerequisite checks, separation of duties check, approvals and provisioning, and a register of every request, as SP 800-53 AC-2 requires.
The requester completes Parts A and B. A supervisor may request for a person they supervise.
The Account manager completes Parts C and D before the request goes for approval.
The approvers complete Part E. Group and role membership needs Fill in: prerequisites and criteria for group and role membership Typical: a completed access request, a signed access agreement and completed security awareness training (AC-2c), and account creation needs approval by Fill in: personnel or roles required to approve requests to create accounts Typical: the user’s supervisor, plus the system owner or data owner for privileged roles (AC-2e). No one approves a request for their own access.
The Account manager provisions only what Part E approves, completes Part F, and enters the request in the register.
Fill in: individual, privileged, service, temporary, or other type the system allows
Roles or groups requested
Fill in: role or group names, as the system defines them
Business need
Fill in: the duties that need this access
Information accessed
Fill in: types of information, and whether it includes personally identifiable information
Start date
Fill in: date
End date
Fill in: for a temporary account or a fixed-term role, the date access ends; otherwise none
Other attributes
Fill in: restrictions to apply, from the attributes the account management procedure records for each account
Remote access needed
Fill in: no; or yes, and the approved method from the remote access standard
The account record holds the authorized user, group and role membership, access authorizations and Fill in: attributes (as required) for each account Typical: an expiration date for temporary accounts, and time-of-day or location restrictions where the system supports them (AC-2d). A temporary account is set to be disabled automatically at its end date, and an emergency account after Fill in: the time period after which to automatically remove or disable temporary or emergency accounts Typical: 72 hours for emergency accounts, and the end date approved at creation for temporary accounts (AC-2(2)).
For a privileged account, the user also keeps a separate non-privileged account for email, web browsing and other nonsecurity functions (AC-6(2)). Name it here: Fill in: non-privileged account ID.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.