A user access review asks one question of every account: does this person still need this access? People change roles, projects end, contractors leave, and access granted for a week stays for years. The review is how that is found.
It is also among the most sampled controls in any audit. ISO/IEC 27001:2022 asks for access rights to be reviewed (control 5.18), and PCI DSS v4 asks for user accounts and privileges to be reviewed at least once every six months (requirement 7.2.4). Auditors seldom fail the review for being missed. They fail it because nobody can show what was reviewed, who decided, and that the removals happened.
Decide the scope and the frequency
| What | Suggested frequency | Reviewed by |
|---|---|---|
| Administrator and other privileged accounts | Every three months | The system owner and the security lead. |
| Systems holding customer, financial or personal data | Every six months | The data or business owner. |
| All other business systems | Once a year | Line managers. |
| Service and application accounts | Once a year | The technical owner of the integration. |
| Third-party and vendor accounts | Every six months, and when a contract ends | The contract owner. |
Pull the data
- Export accounts from the system itself, not from a spreadsheet somebody maintains. The point is to compare what exists with what should exist.
- Include for each account: the owner's name, role or group membership, whether it is enabled, when it was created and when it last signed in.
- Export the current staff list from HR on the same day, with manager and leaving date.
- Record the date and the name of the person who ran each export. Keep the raw files.
- Include accounts that do not belong to a person: service, shared, test and emergency accounts. These are where reviews usually have gaps.
What the reviewer checks
- Leavers. Any enabled account whose owner is not on the staff list is removed today, and treated as a finding about the leaver process.
- Dormant accounts. CIS Controls safeguard 5.3 suggests disabling accounts after 45 days without use. Disable first, delete later.
- Role fit. Does the access match the job the person does now? Look hardest at people who have moved teams, since they collect access from every role.
- Privilege. Does each administrator still need to be one? Administrator rights on an everyday account, used for email and browsing, is a finding by itself.
- Conflicting duties. Nobody should be able both to raise and approve a payment, or to write code and release it to production unreviewed.
- Shared and generic accounts. Each needs a named owner and a reason it cannot be personal.
- Service accounts. Each needs an owner, a purpose, and no ability to sign in interactively where the system allows.
- Multi-factor authentication. List the accounts exempt from it and challenge each exemption.
Who should not review
Nobody reviews their own access. A manager reviews the team, a system owner reviews the administrators, and someone independent reviews the system owner. If IT prepares the lists and IT also approves them, the control has not operated, because the people who know whether access is needed are in the business.
Close it out and keep the evidence
- Every account has a recorded decision: keep, change or remove, with the reviewer's name and the date.
- Each removal has a ticket, and the ticket is closed.
- A second export, taken after the changes, shows the removed access is gone. This is the step most often missing, and the first thing an auditor asks for.
- A short summary: systems covered, number of accounts reviewed, number changed or removed, exceptions accepted and by whom.
- Findings about process, such as leavers not being removed, go to the corrective action log.
- The summary is reported to management, and the date of the next review is set.
Use it with
References
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- PCI Security Standards Council: document library (PCI DSS v4.0.1, requirement 7.2.4)
- NIST SP 800-53 Rev. 5, Security and Privacy Controls, control AC-2 Account Management
- CIS Critical Security Controls v8, Control 5 Account Management and Control 6 Access Control Management