Access Review
What is Access Review?
A periodic evaluation of user access rights and permissions to verify they remain appropriate, required by most compliance frameworks.
Terms that appear alongside access review
Each of these is named in at least one of the same controls as access review. The number is how many controls name both.
- access control 10 shared controls
- audit 3 shared controls
- nist 3 shared controls
- least privilege 2 shared controls
- access management 2 shared controls
- identity and access management 2 shared controls
- authentication 2 shared controls
- phishing 2 shared controls
Frameworks that govern access review
What the standards actually require on access review
Requirements naming access review across 6 standards, quoted from the control text.
Logical access privileges are reviewed and adjusted to conform with access requirements at set intervals, on defined triggers such as restructures, and after any temporary elevation of privilege.
australian-energy-sector-cyber-security-framework-aescsf::ACCESS-2h · ACCESS-2h: Logical access reviewed on schedule, triggers and after elevation →Administrator access review and revocation. Level 1 (a to d): removal or adjustment of access on termination or change; regular review of administrator access rights;
mtcs-singapore::22.4 · Administrator access review and revocation →Recertify user access against least privilege and separation of duties at a frequency set by the organisation's risk tolerance, and withdraw what is no longer justified.
CCM-IAM-08 · User Access Review →Review and re-approve identity access against least privilege and separation of duties at a frequency set by the organisation's risk tolerance, and in any case yearly and after any significant change.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::IAM-08 · Access Review →Use appropriate technological means that let users exercise their right to access, review and correct their personal data directly; the provider must give the third party (if any) all the necessary and regulatory permissions to use any software or other intell...
kuwait-citra-data-privacy-protection-regulation-decision-no-26-of-2024::4.6 · 4.6 Technology for direct access, review and correction →All access held by application and system accounts, together with their related privileges, must be reviewed periodically, at a frequency set by the entity's own targeted risk analysis carried out as Requirement 12.3.1 specifies.
7.2.5.1 · 7.2.5.1 Application and system account access reviewed periodically →Questions people ask about access review
What is Access Review?
Why is Access Review important for compliance?
Which compliance frameworks address Access Review?
Where can I learn more about Access Review?
See how Access Review applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.