Blog · Access reviews · Problem 59 of 93
Your policy says quarterly access reviews. Make them small enough to actually do.
· 3 min read · By Case Jones
You are the CTO or security lead, and your access control policy promises a review every quarter. The last one happened before the last audit, and the next is overdue again.
What it costs to leave it
People keep access they no longer need, including contractors who finished months ago and staff who changed teams. A review your policy promises and you do not perform is a clear audit finding. Doing four at once before the audit is worse, since it shows they never happened on time.
How to run an access review in an afternoon
Reviews get skipped because they feel big. Split them into one small task per system, give each a clear owner, and keep the same three pieces of evidence every time.
- 1
List the systems in scope
Start with the systems that hold customer data or can change production. That is usually your cloud console, code host, identity provider, database admin tools, CRM and support desk. Ten systems done well beats forty done badly.
- 2
Give each system an owner
The owner is the person who knows who should have access, usually a team lead. They review their own system. Spreading the work this way is what makes it fit into an afternoon.
- 3
Export who has access, and compare
For each system, export the user list with roles. Compare it with your current staff and contractor list, and with what each role needs. Mark anyone who has left, changed roles or has admin rights without a reason.
- 4
Remove, then record
Remove or reduce access for everyone marked. Keep three things for each system: the export before the review, a note of what was removed, and the owner's sign-off with a date. That is the record an auditor will ask for.
- 5
Put the next one on the calendar now
Schedule the next review for the same week next quarter, with a reminder to each owner. A review that starts itself happens. One that waits for someone to remember does not.
Example
A sample access review record for one system
System: GitHub. Owner: engineering lead. Export attached, 34 users, taken October 2. Removed: one contractor whose project ended in August, and admin rights from two engineers who no longer need them. Signed off by the engineering lead on October 3, checked by the CTO.
Or set up access reviews in one click
The vendors and systems registers in 93 Compliance list your systems with owners, MFA and review-due dates. The AI can suggest systems from what you have already told it, and it shows a quote from where it found each one.
One click sets up quarterly access reviews as a scheduled procedure, with one step per system. Each step asks for the who-has-access export, the accounts removed and a sign-off. Steps go to each system's owner through team queues, overdue ones remind and escalate, and every run is kept as a record that goes into the audit package. It is free.
- A systems register with owners and MFA
- Quarterly access reviews as a scheduled procedure
- One step per system, routed to its owner
- Evidence of who has access, what was removed and the sign-off
- Reminders and escalation when a review is late
Set up access reviews
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
How often should user access reviews be done?
Quarterly is common for systems with customer data or production access, and some companies review less sensitive systems twice a year. Do whatever your policy says, because that is what an auditor will test.
What evidence do auditors want from an access review?
Usually the list of users at the time of the review, what was changed, and who approved it and when. They may also check that the removals actually happened.
Who should perform the access review?
Someone who knows who should have access, usually the system's owner or a team lead. Where possible, a second person checks the result, so nobody approves their own access.
Can we skip a quarter and catch up later?
You can, but the record will show the gap. A late review is better than none. Record the real date you did it.