What to Provide
An onboarding checklist/access request ticket (or similar evidence) for a sample of employees hired during the audit period demonstrating that IT access to any in-scope production system components for the sampled new hires was approved prior to provisioning access.
NOTE: The audit team will communicate sample selections once they have been finalized. Please refrain from attaching evidence to this ER until samples have been communicated.
Evidence Format
Word/PDF document, exported images in a common image file type (i.e. .jpg, .png, .pdf), Excel/.csv export from the source system
Additional Guidance
The evidence should demonstrate:
Who was granted access
When the access request was made
Who approved the access request
When the access request was approved
List of system access that was granted
When system access was actually granted or form completion date
Associated Unified Control ID | Associated Framework Control |
CTRL-16 | LCL-36 |