People DATA Request Process

Process Overview For Workday System Remediation: You submit an Attribute Release Form describing the data attributes and populations you need The review process is tied to the nature of the data requested: Use of Student data is reviewed more extensively than other populations Use of ‘Restricted’ data (personal, sensitive, confidential) data is reviewed more extensively than other types of data Data Owners review requests and approve (or deny) access to the data A Salesforce workflow is used to track requests and approvals After a request is approved, you work with an ITS BSG team to understand your timeframes, access and access methods, formats, usage, and to discuss the appropriate services for your application ITS configures security to constrain access to approved data Use of ‘3-lock’ data triggers an Information Security risk assessment for systems without up-to-date Security Design Reviews (SDRs)

Access Control for Workday R4 System Remediation People Data Groupings (refer to request form for all attributes within group) Grouping Description Examples of Data Access Control for Workday R4 System Remediation Controlled Unauthorized disclosure, alteration or destruction would result in little or no risk to the University and its affiliates, with the exception of NetID. Faculty/Staff Directory Student FERPA Directory (subset) UPI Yale Email NetID – viewable only by people with a valid NetID, or in service of external authentication (e.g., CAS, Shibboleth) Display Name eduPerson Affiliation(s) or Role(s) Department Job Title Work Phone Primary Enrollment Status Primary Graduate Degree Department Student data minimal review – This group can be approved for student data after FERPA Legitimate Educational Interest is verified. All other populations are pre-approved for access requests Limited Unauthorized disclosure, alteration or destruction could result in a moderate level of risk to the University or its affiliates. Student FERPA Protected Protected by University policy NetID – viewable by people without a valid NetID for a purpose other than external authentication Pay Group Pay Rate Type Continuous Service Date FTE Hire Date Student Leave Status Obtain approval from data owners for every access request Restricted Unauthorized disclosure, alteration or destruction of that data could be misused by a criminal or data that are considered Sensitive. National Identifier (SSN) Date of Birth Date of Death Prox Number Home Address Gender

Request Process Pre-Approval Limited Review & Approval Submittal of Access Request Form Pre-Approval Non-student data Controlled-Basic Controlled-Extended Limited Review & Approval Student data Full Review & Approval (high risk) All Affiliations Limited Restricted People Hub Security Setup and Integration Risk Management For Workday Requests (Vendor Agreements and Security Assessments)

What System Owners need to do If ‘3-lock’ data is requested, Information Security will reach out. Complete an Information Security Risk Assessment prior to Production System Owners Complete the People Attribute Release Form for Workday System Remediation Submit the form via email to Salesforce (email address available soon) Respond to requests for clarification on needs Receive notification when request is approved Submit a ServiceNow ticket for technical delivery of data Consult with central technical team on timeframe, access & access methods, etc. Test technical solution Central Process Business Solutions Team, supported by data owners ITS HR and Payroll Systems Team, supported by other ITS Teams

FAQs For Workday System Remediation People Data Integration Decision Chart I have an Existing Integration: I use IDR today identityaccessrequests@yale.edu IF THEN Therefore: Action Required Form Required w Salesforce email I am not impacted by WD R4. Only deal with identity attributes (Names, Identifiers, Work Phone, etc.) Stay in IDR for an indefinite time period. Would move to People Hub in the future when major re-write is needed for a separate purpose. No action required at this time. n/a AND My system requires data refresh more than once a day. OR My system is internal to IAM My system is impacted by WD R4 and Backbridge decommissioning. Integration needs to be moved to People Hub; should be part of Impacted Systems list. Email Salesforce People Hub Request with subject: "Requesting previously approved IDR for conversion to People Hub." No form is required

FAQs For Workday System Remediation I Need a New Integration: I currently pull People data from the Data warehouse (DWH1), Oracle HR (HOP1), or People File (ACSI1), or I have a change request because I need additional attributes or records. IF THEN Therefore: Action Required Form Required w Salesforce email I need to remediate on or after 7/1/2017 when PeopleHub goes live. Integration needs to be moved to People Hub; should be part of Impacted Systems list. Email Salesforce People Hub request People Hub Request Form OR I need to remediate now or before People Hub goes live 7/1/2017, and I am not impacted by WD R4. Only deal with identity attributes (Names, Identifiers, Work Phone, etc.) Integration needs to be moved to IDR for an indefinite time period. Would move to People Hub in the future when major re-write is needed for a separate purpose. Email Salesforce IDR request (same email address as People Hub) IDR form I need to remediate now or before People Hub goes live 7/1/2017, AND I am not impacted by WD R4. I only deal with attributes in IDR (identity: Names, Identifiers, Work Phone and limited Org Attributes: Org Name, Business Title) Integration needs to be moved to IDR. I need to remediate now or before People Hub goes live 7/1/2017, AND I am not impacted by WD R4. I deal with attributes not in IDR (Position details, Salary and Appointments) These integrations need to obtain data from WD, as IDR may not have position and WD Org data (i.e. Supr Org). Need to build composite service or multiple integrations (from WD and IDR) satisfy this need if they also need unpaid student information and/or enrollment information. Contact your Workday@Yale Impacted Systems Remediation Contact. N/A; your Workday@Yale Impacted Systems Remediation Contact will assist you with the process.

Additional FAQs For Workday System Remediation: Which ITS team receives the ServiceNow request? Create a ServiceNow ticket for Business Service ‘HR and Payroll Systems’ My integration is moving to Workday, not to the People Hub. Do I need to submit a People Attribute Release Request? Yes. You need approval for use of Workday People data. How do I get Cost Center Hierarchy data in addition to People data? Submit a ServiceNow request for Cost Center Hierarchy data