User responsibilities
- Use only your assigned account.
- Keep passwords private and unique.
- Sign out on shared or public devices.
- Verify recipients before sending reports or exported data.
- Do not upload unnecessary personal or confidential files.
- Report suspected unauthorized access, unusual activity, or accidental disclosure.
Administrator responsibilities
- Apply least privilege and segregation of duties.
- Limit privileged, approval, posting, export, and user-management roles.
- Deactivate accounts promptly when staff leave.
- Review access periodically and retain evidence.
- Restrict HR, bank, tax, identity, and payroll-related data.
- Review audit information and investigate unusual changes.