1. Weekly Audit

Each week, Cybersecurity audits KnowBe4 to identify users with overdue training. Any user found past due receives a 24-hour notice stating that their account will be disabled if training is not completed within that window.

 

2. Disable Request to Help Desk

If a user remains past due after the 24-hour notice, Cybersecurity sends a ticket to the Help Desk requesting the account be disabled. The ticket follows this format:

 

To:

Help Desk; all users listed in Listing 2 who are still past due (excluding VPs and above)

CC:

Tom Rojas, Chris Edrington, Michael Brantley, Jim Lee, Michael Johnson (if a KP user is in the To: line), and the affected user's supervisor(s)

Subject:

KnowBe4 Overdue Training – Suspend User Account and Email

 

Body:

Help Desk, please disable the account(s) listed below until Cybersecurity authorizes reinstatement.

 

Mandatory training has not been completed within the required timeline. Training must be completed before the user's email access is restored.

Please make a note on the account to not enable the account again without approval from Cyber.

 

If you supervise a user whose account is being disabled, contact the Cybersecurity team as soon as possible to discuss next steps for restoring access.

 

User(s):

(Use the To: list above, excluding Help Desk.)

 

 

Additionally, the employee IDs listed below must be deactivated to prevent the accounts from being automatically re-enabled during the hourly Active Directory sync.

Keep a record of each employee ID in the Notes section of the user's AD properties so it can be restored once the Cybersecurity authorizes reactivation for the user to complete their training.



 

3. Help Desk Actions

Upon receiving the ticket, the assigned Help Desk agent must:

  • Disable the listed user account(s).
  • Remove the employee ID attribute from each user's Active Directory profile.

 

4. Reactivation

Typically, the user's manager will reach out to request reactivation. When training is complete and approval is granted, Cybersecurity will notify the Help Desk agent via the ticket to restore the employee ID.

 

The user then has another 24 hours to complete training (or longer if a valid exception is granted) before the account is disabled again.