• KSU document the naming convention of Banner and ADP user IDs within a written policy. KSU should then regularly monitor user IDs established within Banner and ADP to ensure these adhere to the naming convention established within this policy.

Management Response: Concur

Plans are underway to require new employees to change their current password prior to first use and for current users upon next log-in attempt.

KSU will regularly monitor and document Banner and ADP naming convention are established within the written policy. Adequate documentation will be maintained from all Banner module managers to ensure reviews are being performed for each module. An additional level of review will be conducted by the either the AVP for Finance and Administration and/or Supervisor of respective areas.

Management Response: Non-concur

KSU current Network, Banner, and ADP passwords exceeds current industry standards using multi-factor authentication and complex passwords. According to NIST Special Publication 800-63B, password expirations are no longer necessary; KSU has benchmark with other Kentucky Higher Institutions which were found to be similar to KSU standards.

• Banner passwords be required to contain both alphanumeric and special characters. The password history for both Banner and ADP should be increased to 24 passwords.

Management Response- Non-concur

KSU current Network, Banner, and ADP password's structure meets current industry standards using alphanumeric and special characters. Reviewing industry standards for passwords length to be increased to 24 characters. According to NIST Special Publication 800-63B, user-created passwords should be at least 8 characters in length; KSU's is currently set to 12 (exceeds requirements) KSU has benchmark with other Kentucky Higher Institutions which were found to be similar to KSU standards.