KSU follow their Password Policy and have a failed login attempt setting of three as opposed to five.

KSU IT staff return Banner Security Forms to supervisors and Banner module managers if the proper selections are not made, and proper signatures are not captured on the form. Actions taken by IT that affect a user's access to Banner should be documented on the form or emails should be retained to support communications. Also, KSU should create a security form to be used when granting access to ADP.

KSU continue performing quarterly audits of Banner and ADP. Adequate documentation should be obtained from each of the Banner module managers to ensure reviews are being performed for each module. The full audit reports should be used by IT staff and Banner module managers to compare and confirm access is appropriate for all users.