Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How often do we review access, and who does the reviewing?

3 decision pointsThe pack behind this answer: User Access Review

Add to board memo

The short answer

Recommendation
Set the frequency by what the access can do: privileged access every 3 months, systems supporting a critical service every 6, and all others every 12, in the pack's defaults. Give each entry to the reviewer who can judge it, and check nobody reviews their own access or their reviewer's.
Reasoning
Privileged access can do the most harm and changes most often, so it is reviewed most often, on every system. An ERP reviewed every 6 months still has its administrator accounts reviewed every 3. The line manager knows whether a person still needs the system; only the system owner can say whether the permissions fit the job. Information security reviews every privileged account a second time and samples every reviewer's decisions.
Considerations
  • The 3, 6 and 12 months are the pack's defaults, set to meet the regulated minimums it cites for critical or important functions under DORA and for cardholder data. Your own method may set shorter ones.
  • If you cannot tell whether a role is privileged, or whether a system supports a critical service, take the shorter frequency until you know.
  • In a small team where independence is impossible, record the conflict and have an external reviewer or internal audit check those entries.
  • Run a review out of cycle after a restructure, a merger, an incident involving misuse of access, or a change of system owner.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartSetting how often a system's access is reviewed, and by whomDecisionCan this access change the system, its users or its security?DecisionDoes the system support a critical service?StepReview it every 3 monthsStepReview it every 6 monthsStepReview it every 12 monthsStepGive each entry to the reviewer who can answer its questionDecisionWould anyone review their own access, or their reviewer's?StepReassign those entries to someone independentOutcomeReview at that frequency, with those reviewers

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 10 steps.

  1. Start

    Setting how often a system's access is reviewed, and by whom

    Answer the frequency question separately for the administrator access and the ordinary access on the system. An ERP reviewed every 6 months still has its administrator accounts reviewed every 3. The frequency is set by what the access can do, not by how convenient the system is to review.

    In the pack

  2. Decision

    Can this access change the system, its users or its security?

    That is privileged or administrator access: administrator groups, super-user roles, database owners. It can do the most harm and changes most often. If you cannot tell whether a role carries administrator rights, treat it as privileged until the system owner says otherwise.

    In the pack

  3. Decision

    Does the system support a critical service?

    Include a critical or important function under DORA, and any system that stores, processes or transmits cardholder data. For these systems the six-monthly review is the regulated minimum the pack cites. If you do not yet know, take the shorter frequency.

    In the pack

  4. Step

    Review it every 3 months

    This applies to privileged and administrator access on every system, whatever the frequency for the rest of that system. A short list reviewed properly every quarter protects more than a long one reviewed carelessly once a year.

    In the pack

    See also

  5. Step

    Review it every 6 months

    Frequencies run in calendar months from the extract date of the last campaign for that system. In a payment card environment, service and system accounts follow the frequency your targeted risk analysis sets; the pack's default is the frequency of the system they run on.

    In the pack

  6. Step

    Review it every 12 months

    This covers every other in-scope system. Run a review out of cycle as well after a restructure, a merger, a security incident involving misuse of access, or a change of system owner.

    In the pack

  7. Step

    Give each entry to the reviewer who can answer its question

    The line manager decides whether each of their people still needs the system for their current job. The system owner decides whether the permissions fit that job, and reviews every privileged, generic, service and third-party account and every entry nobody else could decide. Information security reviews every privileged account a second time and samples every reviewer's decisions.

    In the pack

  8. Decision

    Would anyone review their own access, or their reviewer's?

    Check every assignment. A line manager's own access goes to their own manager. An administrator does not review the group they belong to. The Head of Information Security's own access goes to another executive. If you cannot tell who reviews whom, check before the lists go out.

    In the pack

  9. Step

    Reassign those entries to someone independent

    Where the system owner is in the group they review, their own membership goes to a named executive outside it. In a small team where independence is impossible, record the conflict and have an external reviewer or internal audit check those entries, as a compensating check.

    In the pack

    See also

  10. Outcome

    Review at that frequency, with those reviewers

    Record the frequency and the reviewers in your own inventory of in-scope systems, and plan each campaign from the earliest due date. Changes to the frequencies are approved by whoever approves your access control rules; the pack's default is executive management.

    In the pack

Practical checklist

  1. Set the frequency separately for the administrator access and the ordinary access on each system.
  2. Review privileged and administrator access every 3 months on every system.
  3. Review systems supporting a critical service every 6 months, and all other in-scope systems every 12.
  4. Count each frequency in calendar months from the extract date of the system's last campaign.
  5. Give personal accounts to line managers, and permissions and every privileged, generic, service and third-party account to the system owner.
  6. Send every privileged account to information security for a second review.
  7. Reassign any entry where someone would review their own access or their reviewer's.
  8. Record the frequency and reviewers in your inventory of in-scope systems, and plan from the earliest due date.

Evidence to have ready

  • The inventory of in-scope systems, with each one's owner, scope, frequency and last review date.
  • The reviewer assignments for each campaign, and how each conflict of independence was handled.
  • Your approved review method, including its frequencies and who approves changes to them.

Assumptions

Not covered here