Create Access Review Policy

Background

The Platform Security team has asked the CMS team to undergo the access review process, to be in accordance with ATO. In addition, VA POs have been asking for a more uniformed policy to determine how and where people can be granted access to VA CMS.

VHA users have to go through training. Help Desk would be a good resource for this work,

User Story or Problem Statement

Affected users and stakeholders

CMS editors
Help Desk

Relevant Links

https://vfs.atlassian.net/wiki/spaces/PSEC/pages/2987917734/Access+Review+Process
https://vfs.atlassian.net/wiki/spaces/PCMS/pages/2930082001/Access+Requests
Link to help desk documentation / knowledge base documentation for access granting process

Hypothesis

A hypothesis may depend on a spike ticket to be completed.

We believe that _thissolution will achieve _thisoutcome. We'll know that to be true when this measurable outcome occurs.

Assumptions

(How will these assumptions be validated?)

Acceptance Criteria

Change management triage

The change represented by this user story will:

[ ] Be a site-wide change to appearance or key functionality (such as log-in process)
[ ] Be a specific change that requires more than 30 minutes of work by a user to meet a publishing requirement
[ ] Remove a piece of functionality (such as restricting editing functions, or “hardening”)
[ ] Require action by some or all users by a specific deadline
[ ] Change the front end and be highly visible to the public
[ ] Noticeable performance improvements (publishing speed, predictability)

If you selected an item above, use the Change Management Runbook to create a CM epic and associated tickets.

If you did not select an item above, update issues/PRs in GitHub but don’t plan for change management.

Design principles

Veteran-centered

[ ] Single source of truth: Increase reliability and consistency of content on VA.gov by providing a single source of truth.
[ ] Accessible, plain language: Provide guardrails and guidelines to ensure content quality.
[ ] Purposely structured content: Ensure Content API can deliver content whose meaning matches its structure.
[ ] Content lifecycle governance: Produce tools, processes and policies to maintain content quality throughout its lifecycle.

Editor-centered

[ ] Purpose-driven: Create an opportunity to involve the editor community in VA’s mission and content strategy goals.
[ ] Efficient: Remove distractions and create clear, straightforward paths to get the job done.
[ ] Approachable: Offer friendly guidance over authoritative instruction.
[ ] Consistent: Reduce user’s mental load by allowing them to fall back on pattern recognition to complete tasks.
[ ] Empowering: Provide clear information to help editors make decisions about their work.

department-of-veterans-affairs / va.gov-cms