Identity and Privileged Access Security
Access Review
We compare users' access rights in your systems with their job requirements. Unnecessary access and unowned accounts are compiled into a list ready for removal.
What it is
An access review means the responsible owner confirms whether each right is still needed. In practice, managers often approve long lists in bulk and the process becomes a formality. This service enriches the list before it reaches the approver. Unused rights, departed employees and segregation of duties conflicts are flagged in advance.
Scope
- Directory groups, application roles and database rights
- Accounts compared with HR records
- Accounts and rights unused since a specified date
- Segregation of duties conflicts
- External user, supplier and guest accounts
- Record of approval decisions and audit evidence
The need
When organizations need it
- When your cardholder data environment review is due. PCI DSS requires user accounts and access privileges to be reviewed at least every six months.
- When people frequently change roles and retain access from previous positions.
- When an audit requests evidence of review decisions and the evidence is scattered.
Method
How we work
-
Data collection
We collect accounts and rights from critical systems along with HR records.
-
Initial analysis
We flag rights that are unused, unowned or violate segregation of duties.
-
Approval round
We present rights to owners with a summary to facilitate decisions and record each outcome.
-
Removal and evidence
We verify that removed rights are deleted from systems and prepare the audit evidence set.
Outcome
What you have at the end
Unnecessary rights are removed and every decision is recorded. You gain a repeatable process and an audit-ready evidence set for future rounds.
Frequently asked questions
Which systems should we start with?
Start with applications accessing critical data and privileged groups. The scope expands in later rounds.
Can this process be automated?
Yes. Identity governance solutions and Entra ID access reviews can schedule rounds and send reminders. Running the first round manually helps set up automation rules correctly.
Identity and Privileged Access Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting