Review access every quarter

How to do it

Cover the identity provider, cloud accounts, the code host, databases, the admin tool and each tier 1 vendor. Run the export and comparison as a script, so the review is the same each time. The owner of each system confirms the list and signs off. Save the script output and the removals as evidence. ISO/IEC 27001:2022 control A.5.18 and SOC 2 criteria CC6.2 and CC6.3 expect this review.

Example

const staffById = new Map(staff.map(person => [person.id, person]));
export const accessFindings = (accounts, allowedRoles) => accounts.flatMap(account => {
  const person = staffById.get(account.ownerId);
  if (!person || person.status !== 'active') return [`${account.system}/${account.login}: no active owner`];
  return account.roles.filter(role => !allowedRoles[person.job]?.includes(role))
    .map(role => `${account.system}/${account.login}: role ${role} not allowed for ${person.job}`);
});

def access_findings(accounts: list[dict], staff: list[dict], allowed_roles: dict[str, list[str]]) -> list[str]:
    staff_by_id = {person["id"]: person for person in staff}
    findings = []
    for account in accounts:
        person = staff_by_id.get(account["owner_id"])
        if not person or person["status"] != "active":
            findings.append(f"{account['system']}/{account['login']}: no active owner")
            continue
        findings += [f"{account['system']}/{account['login']}: role {role} not allowed for {person['job']}"
                     for role in account["roles"] if role not in allowed_roles.get(person["job"], [])]
    return findings

How to check

The latest review in the evidence store is less than 92 days old. The script finds no account that is missing from the staff list or that holds a role its job does not grant.