Source + trust record
Source checked as of September 18, 2026. Primary authority: EDD WSD24-12.
Check result: WSD24-12 remains active. CalJOBS access requires a business need, required security/confidentiality documentation, annual access maintenance, and timely deactivation when employment or the business need ends. EDD also conducts quarterly random account reviews. The page’s least-privilege and offboarding recommendations are implementation practices aligned to the directive. This AI-assisted brief does not receive human legal or compliance review. Official sources control.
WDB decision strip
| STATUS | ACTION | PRIMARY OWNER | CURRENT TIMING | IMPACT |
|---|---|---|---|---|
| FINAL · ACTIVE | AUDIT ACCESS + TRAINING CONTROLS | MIS Administrator + Supervisors | Standing CalJOBS access requirement | Security · Confidentiality · User access · Staff onboarding |
The bottom line
CalJOBS access should follow least-privilege, documented approval, required training, and prompt deactivation. Treat user access as an information-security control: staff should have only the permissions their duties require, and Local Areas should be able to show why each active account exists.
What has to happen before, during, and after a staff member receives CalJOBS access
WSD24-12 treats CalJOBS access as an annual information-security control. Staff need a business need, current security and confidentiality documentation, an approved request, role-appropriate access, and timely deactivation when the business need ends.
🚩 Statewide Action Alert. Local Areas that give staff access to CalJOBS must maintain the access-control process in WSD24-12, including annual maintenance and prompt deactivation when access is no longer needed.
At a glance
Agency
California EDD
Directive
WSD24-12
Issued
January 27, 2025
Local action
Required
Core control
Business need + security training + confidentiality documentation
Maintenance
Annual access request update
State oversight
Quarterly random account review
Executive takeaway
WSD24-12 establishes a statewide process for creating, updating, maintaining, and deactivating CalJOBS staff access. A staff member must have a business need for access, complete Information Security and Privacy Awareness training or an approved equivalent, and complete the applicable employee or vendor/contractor confidentiality agreement before access is approved.
The directive also changes account management from a one-time onboarding task into a recurring control. Managers or supervisors must submit an updated CalJOBS System Access Request Form annually, and access must be revoked at or before separation or whenever the business need ends.
Five things to know
- A CalJOBS staff account requires a documented business need.
- The request form records security-training and confidentiality-agreement dates and requires an organization-provided email address, not a personal email.
- Managers or supervisors must complete annual maintenance by submitting an updated access request with current documentation.
- Accounts must be deactivated before or at separation, or when the business need ends.
- The CalJOBS Operations Unit reviews a random sample of staff accounts quarterly for compliance.
The access lifecycle
1. Establish need
The staff member needs CalJOBS for assigned duties and has an organization-provided email account.
2. Complete prerequisites
Complete required ISPA training and the applicable confidentiality agreement before account creation.
3. Approve and maintain
The authorized requestor submits the form through the applicable CalJOBS Access Coordinator. Access is matched to duties and refreshed through annual maintenance.
4. Deactivate promptly
Revoke access at or before separation or as soon as the business need ends. Late deactivation requires immediate correction and state notification.
What the request form captures
- Whether the staff member already has or previously had a CalJOBS staff account.
- The requested action, including account creation, update, or inactivation.
- Organization and staff information, office locations, and additional role access such as DVOP, LVER, TAA, ETPL, corrections, or NFJP.
- Confirmation that there is a business need for access.
- The most recent date of the applicable confidentiality agreement.
- The most recent date of Information Security and Privacy Awareness training or equivalent.
- The requestor and account creator approvals.
Why annual maintenance and offboarding matter
Annual maintenance creates a recurring point to confirm that the person still needs access and that documentation remains current. Offboarding is the higher-risk moment: if a Local Area discovers that an account was not deactivated when access should have ended, the requestor must immediately notify the CalJOBS Access Coordinator, the account must be deactivated, and the CalJOBS Operations Unit must be informed so EDD can determine whether confidential or sensitive data were accessed.
WDB implementation checklist
- Connect HR and CalJOBS offboarding. Make deactivation a required step in staff and contractor separation workflows.
- Calendar annual maintenance. Do not rely on managers to remember access-renewal dates individually.
- Use organization email only. Do not submit personal email addresses on access requests.
- Verify access level against actual duties. Use the least privilege necessary and update access when job duties change.
- Retain evidence. Keep the current request, training certificate, and confidentiality documentation where the MIS Administrator can produce them.
- Review quarterly findings. Use any EDD account-review results to correct system-wide access-control issues.
Implementation traps
- Treating account creation as permanent authorization rather than an annual control.
- Allowing accounts to remain active while a separation is being processed.
- Keeping access because a former staff member might return or occasionally answer questions.
- Updating security training without also updating the access request and required confidentiality documentation.
Source basis and interpretation
Primary policy: EDD WSD24-12 — CalJOBS System Access.
Official access form: CalJOBS System Access Request Form
Related policy: WSD24-13 — Local Area MIS Administrator and WSB CalJOBS SPOC Roles and Responsibilities
How to use this brief: Requirements summarize WSD24-12 and its official access form. Local workflow suggestions are implementation guidance, not additional EDD requirements. The official directive and attachments control if there is any conflict.