Access Review Policy and Procedures
Provide the policy and procedures you use to conduct access reviews for your in-scope production systems.
The policy and procedures should reflect the frequency that the access review is performed and the steps taken.
Access Review Documentation for a Sample
For each sampled selected, provide the access review documentation.
The evidence should demonstrate the following:
The system access listing that was reviewed as a part of the access review process and which systems were reviewed, capturing accounts and groups, roles, or permissions for each production system
The date the review took place and who performed the review
The outcome of each account in the review, including if the reviewer confirmed that all user access is appropriate, or if accounts with access to certain system accounts were flagged for modification or removal
If accounts were flagged for modification or removal, provide a ticket (or system logs or screenshots) to show that this action of modification or removal was completed
Related Articles
Associated Unified Control ID | Associated Framework Control |
CTRL-73 | LCL-38 |