IDM-05 Regular review of access rights
Review all assigned access rights at least once a year using authorised reviewers drawn from the owning organisational units who know the actual duties involved, and correct or withdraw any deviation found within seven d
4
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Deviation log capturing detection date alongside the date the right was actually amended · SIEM / log platform
periodic reviewEvidence produced at each review
- Signed reviewer attestations from the organisational unit owning the reviewed population · Document repository
governing documentDocuments that govern the control
- Recertification campaign schedule with completion statistics for the most recent cycle · Document repository
- Justification of how the reviewer population was chosen for knowledge of the reviewed duties · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Reviewers confirm whole lists in a single action with no sign of individual consideration
- Findings recorded correctly but the entitlement removal happens weeks after detection
- Campaign scope covers named human users only and omits accounts driving automated processes
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIDM-04 Withdraw or adjust access rights as the task area changes · IDM-06 Privileged access rights