Periodic review of user access rights to ensure they remain appropriate and necessary.
Access reviews are periodic examinations of user access rights to verify they remain appropriate. Reviews check whether users still need their current access, identify excessive permissions, find orphaned accounts (former employees), and ensure access aligns with roles. Access reviews are compliance requirements under ISO 27001, SOX, and other frameworks. They should be conducted regularly (quarterly for privileged access, annually for standard) with clear ownership and remediation tracking.
Why It Matters
The DSC Perspective:
Access accumulates over time as people change roles. Without reviews, users end up with far more access than needed. Regular reviews identify and remediate excessive access before it's exploited.