How do you conduct an access review?
Created with AI.
A semiannual access review takes a few hours and eliminates most of the accumulated risk.
- 6 steps
- Total time: 3 h
- Preparation: 1 h
- Result: Access rights that reflect who actually needs what
Required tools
- System administrator — For extracting cast lists and making changes.
- The Managers — They are the ones who know who needs what.
Map
1.Export a list for each security role
Who has which role. Start with the system administrators—the list is usually longer than expected.
2.Find inactive accounts
No login activity in the past ninety days. These are usually former employees or people who have changed roles.
3.Include service accounts and integrations
They are systematically forgotten because no manager owns them. Find out what each one is used for and who owns it.
Clear
4.Send the lists to the managers
Ask them to confirm or decline. Set a deadline. Without a deadline, the responses will never come.
5.Remove anything that cannot be confirmed
The standard should be that access which no one confirms is removed. The opposite rule results in a review with no effect.
6.Note the discrepancies
If the same problem keeps recurring—for example, if a change of role never triggers a clean-up—it is the role-change procedure that needs to be fixed, not the review.
Discussion
Ask a question or share what helped you.
