Review of user access rights
Access reviews are a control with a calendar.
What the published 2016 guidance says
Access reviews are a control with a calendar. The measure is the share of critical systems whose user access rights are reviewed periodically, against all critical systems. Illustrative bands are green from 90 to 100, orange from 70 to 90 and red below 70. Evidence is the review itself, such as an email, a ticket or a formal completion record, not the request for a review. Collection follows a change such as promotion, demotion or departure, and reporting is each semester. The risk owner owns it, the security lead collects, and the security manager is the client.
What it means in practice
Access reviews are a control with a calendar. Count the critical systems reviewed against the critical systems in scope. The evidence is the review record, not the ticket that says a review was requested. Report by semester and keep the asset list current.
Status of this record. For B.18, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the critical system list and the review records. Count the systems reviewed against the list. Record the evidence as the review record or ticket. Report by semester and update the list when a system changes.
Evidence an assessor asks for
- Access controlAsset inventory with criticality classification
- Access controlReview tickets or completion records per critical system
- Access controlSemester pie and line charts
The question an assessor will ask
An assessor will ask for asset inventory with criticality classification. The test for B.18 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Critical systems not classified, so the denominator is unknown
- Reviews performed but leaving no record that can be counted
Before the next review
Before the next review, test this against one live record: critical systems not classified, so the denominator is unknown.
What to check when the revision publishes
When DIS 27004 is published, compare the B.18 Review of user access rights record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.