Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If a reviewer misses the deadline, then what?

3 decision pointsThe pack behind this answer: User Access Review

Add to board memo

The short answer

Recommendation
Keep nothing because a reviewer did not answer. Chase before the deadline, pass open entries to the system owner at the deadline, and send anything still undecided to the Head of Information Security, who decides it or has the access suspended.
Reasoning
Silence is not a decision. Until an entry is decided, people who should no longer have access may still have it, so it is escalated and never kept by default (AR-05). The ladder starts before the deadline, with two reminders. Removal windows still count from the original deadline for every entry, so a late decision leaves less time to remove. That gives everyone a reason to decide on time.
Considerations
  • The day numbers are the pack's defaults, in working days from the extract date. Your own procedure may set others. The pack lets a larger campaign stretch the review phase but keeps the removal windows.
  • Privileged entries cannot wait for the ladder. The system owner already reviews them, so they are decided by the deadline.
  • A reviewer who is unsure should choose Cannot decide and say what they do not know. More than 5% of entries at Cannot decide suggests the extract or the people list is not giving reviewers what they need.
  • Suspended access still needs a real decision: every entry decided is one of the conditions for closing the campaign.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA reviewer still has entries without a decisionStepRemind on day 5, then on day 8 with their manager copiedDecisionAre entries still open at the day 10 deadline?OutcomeAll decided: removals start from the deadlineStepSend the open entries to the system owner to decideDecisionHas the system owner decided them within 2 working days?StepEscalate what is left to the Head of Information SecurityDecisionCan the Head of Information Security decide them now?StepSuspend the access until someone decidesStepRemove within windows counted from the original deadlineOutcomeEvery entry decided, and the reviewer named in the report

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.

  1. Start

    A reviewer still has entries without a decision

    Silence is not a decision. An entry without an answer is escalated and never kept by default, because until it is decided, people who should no longer have access may still have it. The escalation ladder starts before the deadline, not after it.

    In the pack

  2. Step

    Remind on day 5, then on day 8 with their manager copied

    Send reminders only to reviewers with entries open, and give the number still open. The second one says plainly what happens after the deadline. Tell unsure reviewers to choose Cannot decide and say what they do not know: it goes to the system owner and counts as done for them.

    In the pack

  3. Decision

    Are entries still open at the day 10 deadline?

    Close decisions on the deadline day. Privileged entries should not be among them: the system owner is already their reviewer, so they are decided by the deadline.

    In the pack

  4. Outcome

    All decided: removals start from the deadline

    Every entry has one of the four decisions. Removal windows now run from the decision date: 1 working day for privileged access and 5 working days for the rest in the pack's defaults.

    In the pack

  5. Step

    Send the open entries to the system owner to decide

    Send the list the same day, copied to the reviewer and their manager. The system owner decides the entries within 2 working days in the pack's default. Keep the message in the campaign's evidence: escalations are among the first things an auditor asks for.

    In the pack

  6. Decision

    Has the system owner decided them within 2 working days?

    In the pack's example, the system owner decided all fourteen of one warehouse manager's open entries the day after the deadline, so the next step was not needed. If you have not heard back, treat them as undecided.

    In the pack

  7. Step

    Escalate what is left to the Head of Information Security

    Send the remaining entries on day 12, copied to the system owner. The message names the reviewer who left them and the system owner they were passed to.

    In the pack

  8. Decision

    Can the Head of Information Security decide them now?

    They decide the entries themselves where they can judge them. Where they cannot, the access does not stay in place by default while someone finds out.

    In the pack

  9. Step

    Suspend the access until someone decides

    Suspending the access stops it being used while nobody has decided whether it is needed. The entry still needs a real decision before the campaign closes: every entry decided is one of the conditions for closing it.

    In the pack

  10. Step

    Remove within windows counted from the original deadline

    Removal windows count from the decision deadline for every entry, including those decided late by the system owner. Late decisions leave less time to remove. That is deliberate: it gives everyone a reason to decide on time.

    In the pack

  11. Outcome

    Every entry decided, and the reviewer named in the report

    The campaign report names reviewers who did not answer. If many entries end up with system owners, check whether reviewers were given lists they could judge. The pack reads more than 5% of entries at Cannot decide as a sign that the extract or the people list is not giving reviewers what they need.

    In the pack

    See also

Practical checklist

  1. Send the first reminder on day 5 to reviewers with entries still open, giving the number open.
  2. Send the second reminder on day 8, copied to the reviewer's manager, naming the deadline and what happens if it is missed.
  3. Close decisions on day 10, and send open entries to the system owner the same day, copied to the reviewer and their manager.
  4. Send anything the system owner has not decided within 2 working days to the Head of Information Security, copied to the system owner.
  5. Have the access suspended for any entry the Head of Information Security cannot decide, until someone does.
  6. Remove access within windows counted from the original deadline: 1 working day for privileged access and 5 for the rest.
  7. Name the reviewers who did not answer in the campaign report.

Evidence to have ready

  • Every reminder and escalation message, with its date and recipients, in the campaign's evidence file (AR-10).
  • The decision for every entry, including those the system owner or the Head of Information Security decided.
  • Any access suspended while undecided, and the decision that followed.
  • The campaign report, naming the reviewers who did not answer.

Assumptions

  • The review runs as a campaign with a single decision deadline, and each entry has an assigned reviewer.
  • Day numbers are working days from the extract date. The timetable shown is the default in the CISO Times access review pack; your own procedure may set different days.
  • The Head of Information Security is the pack's name for the most senior security role. Use whoever holds that role in your organisation.

Not covered here