All templates
Procedure template
Access Review Procedure
Repeatable steps to confirm every account and permission is still needed, and to prove it.
Inside the document
- Plan the cycle
- Extract and prepare the data
- Review
- Remediate
- Close and report
Plus document control, roles, exceptions, enforcement, review cycle and an auditor evidence checklist.
Sample clause · ReviewDecide on every entitlement. The reviewer marks each line Keep, Modify or Remove. A reason is required for anything kept that is flagged. Silence is not approval and bulk-approve without reading is not acceptable.
What an auditor will check
Complete extracts taken from the system, a sound reviewer, decisions on each entitlement, removals done and verified, and a dated sign-off.
Reference mapping: ISO/IEC 27001:2022 Annex A 5.18, 8.2 · SOC 2 (2017 criteria) CC6.2, CC6.3 · NIST CSF 2.0 PR.AA-05. Starting point to be adapted by the organisation to its own context. Not legal advice.
Download (.docx, 42 KB)
Free. Enter your email once to unlock all downloads.
Practise it: Access Review LabFree, simulated and in your browser.