1. Planning.

• Assessment
  Start by determining who needs access, the resources they require, and their purpose. Review and document current access rights and identify if they can be minimized or removed. Consider using a tool for entitlement discovery to gain better insight.
• Policy creation
  Establish definitive policies for granting and revoking access. Set forth rules regarding who is permitted to request access, under what conditions, and for what length of time. Particularly for high-level roles, implement time-limited parameters.
• Source of truth
  Sync your JIT access with an Identity Provider (e.g., Okta, Google Workspace, Azure AD, OneLogin) for a single, reliable source of identities. De/escalating individual identities instead of shared accounts provides better control over authorizations and improves audit accuracy.

2. Execution.

• Self-service access requests
  Make the procedure simpler by letting users request access through the system instead of people. Boost adoption rates by integrating the platform with instant messaging software like Slack or MS Teams. Ensure requests include details of who is asking, the necessary service/resource/role, duration, and reason.

• Approval process
  JIT access presents an opportunity to delegate approvals to individuals with business context, such as resource owners and unit managers, as they often have better insight than IT helpdesks. Use messaging platforms for quick responses, providing all the necessary information for a well-informed decision.

• Conditional approval workflows and integrations
  Incorporate your predefined policies in workflows that set access permissions. Consider integrating JIT with other IT and security systems for additional flexibility.

• Automated provisioning and depovisioning
  Gain a solid understanding of Civil Analytics to effectively grant and revoke access automatically within the software. This is crucial for JIT Access as it reduces reliance on people's availability and permits automated depovisioning of access. Ideally, you would manage all permissions in one location, without having to create or manage an environment for every application in your organization.
• Access methods
  For Civil Analytics JIT Access, APIs are ideal due to their versatility and real-time capabilities. However, a hybrid approach might be necessary, for example, using SAML for authentication, SCIM for user provisioning, and APIs for precise access control decisions.

3. Maintenance.

• Regular audits
  Routinely check access logs to confirm that JIT access is functioning as anticipated. Look for any unusual patterns or actions either directly or by feeding the logs into your SIEM.
• User training
  Inform users, especially those with high-level access, about the importance of minimal privilege, JIT Access, and how it operates.
• Feedback loop
  Regularly review your JIT access procedures and gather user and IT staff feedback to identify potential improvements.

By following this structured approach, you'll effectively implement a robust Just-in-Time Access system for Civil Analytics.