Access review workbook
Document account owners, business needs, reviewer decisions and removal evidence.
Review with the right owner
Give the reviewer enough context to decide: identity, system, role, privileges, employment status and business need. A manager and data owner may have different responsibilities.
Close the loop
Record a keep, modify or remove decision with a reason. Track remediation to completion and retain evidence. Prioritise privileged, departed and conflicting access.
Use this as a starting point.
Adapt the resource to your organisation’s scope, risk methodology, policies and applicable requirements. Examples are fictional and intended for learning.
Created by CyberJA Academy. Free for personal learning and internal use. Do not enter sensitive organisational information into the assessment.