Employee Onboarding and Offboarding �Task Force Recommendations�HCM/Security Cross-Functional
College-led Process Alignment Task Force for Employee Onboarding & Offboarding (EO&O)
�Presented to ctcLink College Collaboration Group (cCCG) August 26, 2026
1
Agenda
Overview of Task Force
Benefits of Process Alignment
Scope of Work
Progress Report
Recommendations
Enhancement Request Recommendations
Questions
2
EO&O Task Force Membership Roles
25 + representatives from colleges & SBCTC agency
3
EO&O Task Force Members
4
Benefits of Process Alignment
5
Task Force Objectives & Responsibility
6
ctcLink Guiding Principles that apply to Process Alignment
7
Recommendation Presentation Status�
9
Today we are finishing Security Specific Enhancement Request and specific HCM and Security Cross-Functional Processes recommendations.
Training will be presented at the September 9, 2026 meeting.
Email HCM and Security Cross-Functional Processes will be presented at a future meeting.
HR specific recommendations and enhancement requests were presented on July 8, 2026.
Security recommendations were presented on July 22, 2026.
The Scope of Work Processes on the next slide are covered today.
Scope of Work: Employee Onboarding �The alphabetic letters align with recommendation numbering
10
Progress Report – August 2026
11
Recommendation Status
Recommendations for Sustainable Success Grounded in Strategy
12
The recommendation codes that follow are not sequential as this is a partial list.
College Business Process �Recommendations
13
SEC B.1.1/HCM B.1.1 �Job Position Documentation
Process
Job Position Documentation for onboarding new employees used by HCM, Supervisor, ctcLink Security, and employee
Current State
Security permissions are being granted reactively using "copy another employee's access" approaches, and supervisors typically identify third-party app needs only after a new hire is onboarded.
Local Security Administrators (LSAs) understand technical access but lack business process context, while supervisors and HR lack technical literacy regarding ctcLink security pillars, FSCM approval functions, and PII masking requirements.
14
SEC B.1.1/HCM B.1.1 �Job Position Documentation (Slide 2)
Current State Continued
No single shared tracking mechanism or integrated workflow exists between HR, LSAs, supervisors, and training teams, leaving ownership and accountability for managing security permissions ambiguous.
Inconsistent documentation regarding sensitive PII visibility and financial approval authorities leaves institutions exposed to significant compliance, audit, and data privacy risks.
While broad pillar security allows for organizational flexibility, they currently fail to explicitly map required training, pre-established security roles, or third-party app access prior to day-one onboarding.
15
SEC B.1.1/HCM B.1.1 �Job Position Documentation (Slide 3)
Recommendation – College Business Process
Human Resources, Supervisors, Data Approvers, and ctcLink LSAs should work together to ensure that every job position at a college has the following documentation available for new employees, Human Resources, supervisors, Data Approvers, and ctcLink LSAs: ctcLink pillars and/or modules associated with the role, whether the position includes level of access to Personally Identifiable Information (PII), and a list of 3rd Party State Software systems, including Legacy Applications. This information can be included in the Job Description or an Access Appendix.
16
SEC B.1.1/HCM B.1.1 �Job Position Documentation (Slide 4)
Future State
HR, supervisors, Data Approvers, and ctcLink LSAs actively collaborate to maintain accurate, shared position requirements across the employee lifecycle.
Every position features an integrated Job Description or Access Appendix accessible to all key stakeholders prior to onboarding.
System needs are defined upfront, specifying the exact ctcLink pillars and functional modules required for the position.
Clear documentation of PII access levels ensures data privacy compliance, proper masking, and audit readiness from day one.
Roles explicitly list all required third-party state software systems and legacy applications needed to perform the job.
LSAs and supervisors accurately grant required permissions eliminating reactive provisioning and risky "copy access" habits.
17
SEC B.1.2/HCM B.1.5�Shared Space
Process
Job Position Documentation for onboarding new employees used by HCM, Supervisor, ctcLink Security, and employee
Current State
Information regarding ctcLink roles, PII masking levels, third-party software needs, and required training lives in siloed Security spreadsheets, emails, or individual heads.
No shared repository exists for HR, LSAs, Data Access Approvers, and supervisors to collaboratively view, update, or audit position-based access requirements.
Required functional and compliance training is disconnected from security role assignment leading to confusion regarding what training is required.
Handoffs between HR, hiring supervisors, Data Access Approvers, and LSAs rely on manual communication, causing onboarding delays and confusion over ownership.
18
SEC B.1.2/HCM B.1.5�Shared Space (Slide 2)
Recommendation – College Business Process
Colleges should create a shared space for LSAs, Data Access Approvers, Supervisors and HCM to track by job Position the ctcLink roles required, levels of access (PII and Masking), 3rd party software, and training requirements.
19
SEC B.1.2/HCM B.1.5�Shared Space (Slide 3)
Future State
A unified, shared workspace gives HR, LSAs, Supervisors, and Data Access Approvers real-time visibility into position requirements across the institution.
Every job profile clearly tracks required ctcLink security roles, third-party software, PII masking levels, and mandatory training in one central location.
Functional and compliance training requirements are linked directly to security profiles, ensuring system access is granted only after prerequisites are completed.
A standardized shared workspace eliminates communication gaps between HR, supervisors, Data Access Approvers and LSAs.
LSAs manage security templates while HR and Supervisors maintain core job descriptions, keeping position requirements accurate as roles evolve.
Centralized tracking establishes a reliable, transparent audit trail for PII visibility, system permissions, and compliance monitoring.
20
SEC B.1.4/HCM B.1.6�Secondary User ID
Process
Onboarding an employee who needs elevated rights in HCM, Finance and CS at a secondary college
Current State
Employees are being given security at two institutions that allows them elevated rights in HCM, Finance and CS at both schools.
LSAs may not know that a Secondary ID is an option.
Security is complicated and understanding who needs a secondary ID is not always understood.
There is no explanation describing who needs a secondary ID for Segregation of Duty conflicts, audit restrictions, etc.
21
SEC B.1.4/HCM B.1.6�Secondary User ID (Slide 2)
Recommendation – College Business Process
Utilize the Requesting Secondary User Id’s in ctcLink (made into a qrg) to determine when a Secondary User ID is needed.
Requesting Secondary User Id’s In ctcLink
Future State
Employees are provided a Secondary ID at one of the institutions so they do not have elevated rights at both institutions.
LSAs are aware of and know how to acquire a Secondary ID.
There are clear guidelines with a decision tree to assist in determine who needs a secondary ID for Segregation of Duty conflicts, audit restrictions, etc.
22
SEC C.1.1/HCM C.1.1�Manager Delegation 2.1
Process
Supervisor/Budget Manager delegating approval responsibility to another employee while out on leave
Current State
Supervisor are delegating to non-supervisory employee in ctcLink.
Non-supervisory staff (particularly union-represented classified employees or faculty) that have strict job descriptions are being delegated to which means they may be "working out of class," opening the organization to labor grievances, mandatory wage adjustments, or union disputes.
Non-Supervisors approving time and spending may not have knowledge of labor laws (FLSA, FMLA), departmental budgets and procurement rules.
Granting managerial permissions to non-managers violates least-privilege security principles, triggering audit red flags and compromising financial controls.
23
SEC C.1.1/HCM C.1.1�Manager Delegation 2.1(Slide 2)
Recommendation – College Business Process
Delegations should only go to users with comparable functions and security; e.g. supervisor to supervisors. If a supervisor needs to delegate to a direct report who is not a supervisor, the re-assignment should go through Human Resources.
24
SEC C.1.1/HCM C.1.1�Manager Delegation 2.1(Slide 3)
Future State
Necessary reassignments to non-supervisors are vetted by Human Resources beforehand, preventing job misclassification, union grievances, and unapproved out-of-class work.
Approval workflows remain strictly within managerial ranks, ensuring decisions are made by personnel with budget visibility and proper training on labor laws and procurement rules.
System access rights strictly align with actual job roles, enforcing the principle of least privilege and satisfying compliance audits.
25
Enhancement Request Recommendations
26
Enhancement Requests
Recommendation – Customization Enhancement Request
27
Questions
28
Recommendation Next Steps
29