IDM-04 Withdraw or adjust access rights as the task area changes
When a person's duties or a system component's tasks change, adjust or revoke privileged access within 48 hours and every remaining access right within 14 days, repeating the granting procedure before any right is restor
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Change records for system components whose function in automated authorisation was reassigned · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Human resources feed or transfer notification that triggers the entitlement change · Policy repository / GRC workspace
- Timestamp comparison of role change effective dates against privileged revocation times · Policy repository / GRC workspace
- Sample of internal transfers evidencing removal of residual rights inside the fourteen day limit · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Transferred staff accumulate rights because new entitlements are added and old ones never removed
- Elapsed time measured from ticket creation rather than from the date the role change took effect
- Contractor assignment changes never reach the access team because no notification path exists
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIDM-03 Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins · IDM-05 Regular review of access rights