Access Review
What is Access Review?
A periodic evaluation of user access rights and permissions to verify they remain appropriate, required by most compliance frameworks.
Terms that appear alongside access review
Each of these is named in at least one of the same controls as access review. The number is how many controls name both.
- access control 10 shared controls
- audit 3 shared controls
- nist 3 shared controls
- least privilege 2 shared controls
- access management 2 shared controls
- identity and access management 2 shared controls
- authentication 2 shared controls
- phishing 2 shared controls
Frameworks that govern access review
What the standards actually require on access review
Requirements naming access review across 6 standards, quoted from the control text.
Physical access rights to data centers and restricted areas are reviewed periodically by responsible owners
CO-PhysicalAccess-2 · Physical Access Review →Recertify user access against least privilege and separation of duties at a frequency set by the organisation's risk tolerance, and withdraw what is no longer justified.
CCM-IAM-08 · User Access Review →On parental request, and after reasonable verification, the operator provides the parent with a description of the types of PI collected from the child, the opportunity to refuse further use/collection, and the means to delete the child's PI;
ESRB-PC-12 · Parental access, review and deletion rights →User access rights are periodically reviewed and recertified by data and system owners with timely revocation of unneeded access.
IS-IV.B.4 · Access Reviews and Recertification →Access review and recertification. Control from ISO 27043 framework, domain: ISO 27043: Access Control.
ISO27043-15 · Access review and recertification →Access review and recertification. Control from ISO/SAE 21434 framework, domain: ISO/SAE 21434: Access Control.
ISO21434-15 · Access review and recertification →Questions people ask about access review
What is Access Review?
Why is Access Review important for compliance?
Which compliance frameworks address Access Review?
Where can I learn more about Access Review?
See how Access Review applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.