1. Planning.

• Assessment
  ‍Start by determining which team members require access, what resources will be necessary for them, and the objective behind it. Document existing access rights and assess if they can be minimized or excluded. A tool for entitlement discovery may prove beneficial in gaining better insight.
• Policy formulation
  Clearly outline policies for both allocating and withdrawing access. Include instructions about who can request access, under which scenarios, and for what duration. Particularly for privileged roles, establish finite time parameters.
• Source of truth
  ‍Sync your JIT access system with an Identity Provider (e.g., Okta, Google Workspace, Azure AD, OneLogin). This Identity Provider will function as the definitive source for identities. Choosing to elevate or de-elevate individual identities over shared accounts will enable better authorization control and precise audits.

2. Execution.

• Self-administered access requests
  Streamline the procedure by allowing team members to request access via the system, not through other individuals. Boost utilization rates by integrating with IM tools like Slack or MS Teams. Ensure requests detail who is requesting, what service/resource/role is required, its duration, and the rationale.

• Approval process
  JIT access provides the chance for organizations to assign access authorization to those with the necessary business context. Resource owners and business unit leaders often possess better context than IT support desks. Using messaging platforms for quick responses, provide all essential information so that those giving approvals can make informed decisions.

• Conditional approval workflows
  Incorporate your predefined policies into workflows dictating permissions for access. Place them into workflows stipulating who can access which resource, and under what conditions. One effective method is to implement if-then conditions such as: IF team “X” requests access to “Y”, seek approval from “Z” and notify “M”.

• Integrations
  ‍Consider integrating JIT access with other IT and security systems for added flexibility. Link with IT ticketing systems for automated access based on ticket status. Connect with data classification systems to adapt policies according to data sensitivity. Ideally, you should possess the capability to tag resources and group them together to streamline this process. Work in tandem with on-call schedule software for automated approvals in times of urgent need. Utilize training systems to grant access upon completion of relevant training.
• Automated provisioning and deprovisioning
  Acquire a thorough understanding of Whimsical to efficiently grant and revoke fine-grained access within the service automatically. This is critical for JIT Access as it decreases reliance on waiting for human availability. It enables automated depovisioning of access, which sits at the heart of JIT access and the principle of least privilege access (POLP). Ideally, you should manage all permissions in one location, without needing to build or administer an environment for every application in your organization.
• Access methods
  For Whimsical JIT Access, APIs are preferable due to their flexibility and real-time capabilities. However, a combination of methods might be necessary. For instance, use SAML for authentication, SCIM for user provisioning, and APIs for precise access control decisions.

3. Maintenance.

• Regular audits
  Systematically review access logs to verify that JIT access is operating as planned. Look for any unusual patterns or behavior either directly or by passing the logs into your SIEM. Automating the user access review process can expedite evidence collection, delegate reviewers, and ensure your system adheres to relevant industry standards or regulations.
• User training
  Train users, particularly privileged users, about the importance of least privilege, JIT Access, and its workings. Ensure users understand how to request access when necessary.
• Feedback loop
  Continuously review your JIT access procedures and solicit feedback from users and IT staff to understand where improvements can be made. In following this structured approach, you'll be able to effectively establish a reliable Just-in-Time Access system for Whimsical.