How do we decide which systems belong in the review?

Start

Deciding whether a system belongs in the access review

Take each candidate system in turn. Start with the systems behind your critical services and every system that gives administrator access. A small organisation can begin with the directory administrator groups, the finance system and the system customers use, and add the others at the next campaign.

• Then: Does it support a critical service?

Decision

Does it support a critical service?

Include any system supporting a critical or important function under DORA, and any system that stores, processes or transmits cardholder data. If you do not yet know which services are critical, answer yes for now.

• Yes, or not known: Add it to the inventory with its scope and frequency
• No: Does it hold personal, financial or sensitive business data?

Decision

Does it hold personal, financial or sensitive business data?

Commercially sensitive data counts as well as personal and financial data. A shared finance drive is as much in scope as the finance application. If you do not know what it holds, answer yes until someone who does has looked.

• Yes, or not known: Add it to the inventory with its scope and frequency
• No: Does it grant administrator access to other in-scope systems?

Decision

Does it grant administrator access to other in-scope systems?

Directories, cloud consoles, firewalls, databases and backup systems all qualify. Administrator access to the directory reaches every other system, which is why the pack reviews it most often.

• Yes, or not known: Add it to the inventory with its scope and frequency
• No: Does it move money, change key records or approve transactions?

Decision

Does it move money, change key records or approve transactions?

Key records are supplier and customer records, such as bank details. These systems carry the fraud risk that segregation-of-duties checks in the review are meant to catch. Add any other test your organisation needs here.

• Yes, or not known: Add it to the inventory with its scope and frequency
• No: Leave it out, and test it again when the system changes

Outcome

Leave it out, and test it again when the system changes

It meets none of the tests. Physical access to buildings, and customers' own accounts without administrative rights, are outside this review anyway. Run the tests again when the system changes, and whenever the review method itself is reviewed.

Step

Add it to the inventory with its scope and frequency

Give it a system ID that never changes, and the scope that sets its frequency. A system with both administrator and ordinary access needs two rows, or one row reviewed at the shorter interval. Leaving out a system that meets a test is a formal exception in your exception register.

• Then: Include every account, not only staff accounts

Step

Include every account, not only staff accounts

Personal, privileged, generic or shared, service and third-party accounts are all reviewed. A supplier's support staff are third-party accounts. Service accounts are reviewed with the system they run on. Note which kinds the system has, so the right reviewers are assigned.

• Then: Does it have a named system owner?

Decision

Does it have a named system owner?

The system owner is the manager accountable for the system. They decide what its roles allow and answer for its privileged and generic accounts. Without one, nobody can decide the permissions.

• Yes: Has a test extract listed every account with all four fields?
• No, or not known: Raise the gap as a finding and fix it before the campaign

Decision

Has a test extract listed every account with all four fields?

The four fields are name, role, permissions and last sign-in. The count must match the system's own count, and local accounts outside the directory must be included. Test it before the campaign's extract date. If it has not been tested, answer no.

• Yes: In scope, and ready for its next campaign
• No, or not known: Raise the gap as a finding and fix it before the campaign

Outcome

Raise the gap as a finding and fix it before the campaign

A system without an owner, or without a way to extract who has access, cannot be reviewed. That is itself a finding, reported with the campaign. If the system cannot give last sign-in, find where it comes from, usually the directory, or have the system owner name every unused account.

Outcome

In scope, and ready for its next campaign

The system is listed with its owner, scope, account kinds and a tested extract. Plan the next campaign from the earliest review due date across your inventory.