KSU make the necessary payments to retrieve the documentation maintained in third-party systems to comply with record retention requirements.

KSU determine whether to continue using a third-party system.

If a third-party database is used, KSU policies and procedures incorporate actions necessary to prevent the temporary or permanent loss of data.

KSU update all Banner and ADP policies and procedures to ensure staff can properly perform their job duties. Given the amount of turnover at KSU, it is imperative to have up-to-date policies and procedures that staff can follow to ensure processes are performed as intended by management.

KSU follow their Password Policy and have a failed login attempt setting of three as opposed to five.

KSU IT staff return Banner Security Forms to supervisors and Banner module managers if the proper selections are not made, and proper signatures are not captured on the form. Actions taken by IT that affect a user's access to Banner should be documented on the form or emails should be retained to support communications. Also, KSU should create a security form to be used when granting access to ADP.

KSU continue performing quarterly audits of Banner and ADP. Adequate documentation should be obtained from each of the Banner module managers to ensure reviews are being performed for each module. The full audit reports should be used by IT staff and Banner module managers to compare and confirm access is appropriate for all users.