AL Refs: AMG07, ACL04, ACL13
Purpose
The purpose of the user access review (UAR) is to identify and correct:
- Any access incorrectly provisioned;
- Any access privileges no longer required;
- Improvements to the way access is restricted to the minimum required.
Where (1) and (2) are identified, investigation should be performed to determine the root cause and whether this represents a control failure to be logged in the .
Review Steps
Log in to the access control list (ACL) of each system in scope and check whether:
- Only active employees with job responsibilities that require access to the system are included on the ACL;
- The the ACL privileges are appropriate based on the least privileged access required to conduct their role or provide appropriate redundancy for administrator roles;
- There is an opportunity to further restrict access without compromising on business requirements.
Example UAR Evidence
