Clearance Watchdog for C•CURE 9000
Key features
Managing access control in a large organization can get complicated fast. Different people need different clearances for projects, departments, or locations. And not every clearance is managed by a central authority. Over time, this leads to unnecessary or outdated clearances that create security risks.
Clearance Watchdog helps you spot and fix these issues automatically, reducing risk and easing the burden on clearance owners and security teams.
The Problem
Even with good processes in place, employees can end up with more access than they actually need. This happens when:
- Projects & Temporary Roles – Employees get special access for a project, but keep it long after the project ends.
- Job Changes – Promotions, department transfers, or filling in for a colleague often result in new clearances—but old ones are rarely removed.
- Human Error – Wrong requests or mistakes during programming can assign the wrong clearance.
- Overlooked Expirations – Clearance owners are busy, and removing access at the right time is often forgotten.
The result: People keep access to sensitive areas they don’t need, sometimes for years.
Existing Tools (and Their Limitations)
Most access control systems already include some clearance management tools. Unfortunately, they don’t fully solve the problem:
-
Time-Based Expiration – Works if you know the exact end date. But projects and temporary roles rarely fit neat timelines.
-
Custom Clearances – Flexible, but hard to manage in large setups. One change can break consistency.
-
Expiring Clearances (Global) – Lets you expire a clearance, but applies to everyone, not just one person.
-
Expiring Clearances Per Person – More precise, but only works with specific hardware (iStar Ultra).
-
Reviewing Clearances – Relies on clearance owners to regularly review access lists. But without complaints, most assume “no problems = no changes.”
Threshold specification
Specify the applicable thresholds in number of unused days before removing a clearance assignment from a person. You can do this per Clearance/Personnel Type combination.
Example configuration:
Methodology
The Clearance Watchdog is a Windows Service that will sync with the C•CURE 9000 database on a specified schedule. Keeping track of clearance usage on a personal level, it can easily detect clearances that are not used by an individual and have them removed from their profile.
