IT-04 Access Requests and Offboarding

Revision 3 · Effective 2025-06-16

1 Purpose

This procedure controls how Tallgrass accounts and access are granted, changed, reviewed and removed, so that each person has only the access their job requires and access ends promptly when it is no longer needed.

2 Scope

This procedure covers Microsoft 365 accounts, SharePoint sites, Teams, ERP roles, DNC server access, shared mailboxes and IT-issued equipment for employees and contractors at the Wichita plant and the Overland Park office.

3 Definitions

IT-F-04 Access Request: the form, submitted through the help desk, used to request new accounts and any change in access.
Data owner: the manager accountable for a SharePoint site or system: the Quality Manager (Quality site), the HR Manager (HR site) and the Engineering Manager (Engineering site).
Sponsor: the Tallgrass employee responsible for a contractor's account and conduct.

4 Responsibilities

Requesters and managers submit IT-F-04 and approve only the access needed for the job.
Data owners approve access to their sites and complete quarterly access reviews.
HR opens onboarding and offboarding tickets and verifies U.S.-person status where EXP-01 requires it.
IT fulfills approved requests, disables accounts on offboarding, and keeps the records in section 7.

5 Granting access

5.1 Requests

All access is requested on IT-F-04 through the help desk (helpdesk@tallgrasspc.com, ext. 2210). Verbal or Teams requests are not accepted. Every request needs the requester's manager's approval. Access to the Quality, HR or Engineering SharePoint sites also needs approval from the data owner for that site. IT fulfills approved standard requests within 2 business days.

5.2 New hires

HR opens the onboarding ticket at least 3 business days before the start date, with the job title and manager. The manager completes IT-F-04 for the role. On day one the new employee registers MFA with IT (IT-02) and acknowledges IT-01.

5.3 ITAR Programs site

Access to the restricted "ITAR Programs" SharePoint site is limited to U.S. persons verified by HR and is granted only under EXP-01. IT will not add anyone to that site without HR's recorded verification.

5.4 Contractors

Contractor accounts need a named Tallgrass sponsor on IT-F-04. For example, the contract CMM programmer from Plains Metrology Services is sponsored by Quality. Contractor accounts expire automatically after 90 days. The sponsor may renew for another 90 days by submitting a new IT-F-04 before expiry; expired accounts are disabled without further notice. Contractors receive only the sites needed for their work and are labeled "(Contractor)" in the company directory.

5.5 Role changes and transfers

When an employee changes role, the new manager submits IT-F-04 for the new access. Access that the new role does not need is removed within 5 business days of the transfer date.

6 Removing access

6.1 Offboarding timeline

HR opens an offboarding ticket for every departure. IT disables the account within 4 hours of HR's offboarding ticket. For involuntary terminations the account is disabled immediately, coordinated with HR so that access ends before or during the separation meeting.

6.2 Offboarding steps

IT completes these steps and records each one on the ticket:

Disable the Microsoft 365 account, revoke all sign-in sessions and remove MFA methods.
Remove ERP, DNC and shared mailbox permissions, and remove the user from all groups.
Selectively wipe company data from any personal phone (IT-01).
Collect the laptop, any IT-issued encrypted USB drive and company phone; HR collects the badge.
Convert the mailbox to a shared mailbox and retain it per IT-07; the manager may request access on IT-F-04.
Give the manager access to the departed user's OneDrive for 30 days to move business files to SharePoint.

6.3 Quarterly access reviews

Each quarter, IT sends each data owner a list of who has access to their site or system. Data owners confirm or remove each person within 10 business days of receiving the list. Removals are completed by IT within 2 business days.

7 Records

IT-F-04 forms, onboarding and offboarding tickets, and signed quarterly access reviews are kept in the help desk system. Access review records are evidence for customer cybersecurity audits.

8 Revision history

Rev	Date	Change	Approved by
2	2023-03-06	Added contractor sponsor and 90-day expiry.	Sam Kettering
3	2025-06-16	Added 4-hour offboarding target and immediate disable for involuntary terminations; added quarterly data-owner access reviews; mailbox conversion per IT-07.	Sam Kettering