The steps
- Choose the systems: start with those holding sensitive data, and with admin rights.
- Export the current accounts and rights from the system itself.
- Send each manager or system owner the list of what to review.
- Have them keep, change or remove each entry.
- Apply the removals, and check that they happened.
- Keep the evidence: the list, the decisions and the changes.
How often
Frequency follows risk: quarterly is common for privileged access and critical systems, and every six to twelve months for the rest. Whatever you decide, write it down in your policy and keep to it.
What reviewers miss
- Leavers and movers whose access was never removed.
- Service accounts with no owner.
- Rights granted directly, outside the role model.
- Reviewers who approve everything: sample their decisions.
What the rules say
ISO/IEC 27001:2022 Annex A control 5.18 covers access rights, including their review. PCI DSS requirement 7 and the HIPAA Security Rule also require managing and reviewing access.
Questions
- Who should review access?
- Someone who knows the need: the person's manager or the system owner, not the person who administers the system alone.
- What evidence do auditors want?
- A complete list taken from the system, the reviewer's dated decisions, and proof that the removals were carried out.