What to Provide
(1) The documented policy/procedure that defines your organization's process for performing user access reviews.
(2) Evidence demonstrating that a user access review was executed in line with the frequency defined in your organization's policy/procedures.
NOTE (1): If user access reviews are executed at an annual frequency, please provide the most recently completed annual user access review.
NOTE (2): If user access reviews are executed at a recurring frequency (i.e. monthly, quarterly, semi-annually, etc.), please provide evidence for the sampled frequencies as defined within the ER description.
Evidence Format
(1) Word/PDF document
(2) Word/PDF document, Excel file, screenshot from ticketing system
Additional Guidance
The evidence should demonstrate the following:
The system access listing that was reviewed as a part of the access review process and which systems were reviewed, capturing accounts and groups, roles, or permissions for each production system
The date the review took place and who performed the review
The outcome of each account in the review, including if the reviewer confirmed that all user access is appropriate, or if accounts with access to certain system accounts were flagged for modification or removal
If accounts were flagged for modification or removal, provide a ticket (or system logs or screenshots) to show that this action of modification or removal was completed
Associated Unified Control ID | Associated Framework Control |
CTRL-73 | LCL-38 |