Access Provisioning Log
Records every grant, change and removal with request reference, approver and completion timestamp.
Available soon
- Format
- Excel
- Size
- 98 KB
- Length
- 12 sheets
- Version
- 2.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: every lifecycle event with its source record, approvers, maker, the deadline it sets and whether it was met, a record check for JML-04, JML-05, JML-07 and JML-14, the live non-standard rights with JMM-04, the lifecycle events, approvals and evidence, and a Summary by event with the example's three late entries.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the as-at date and the timings on the Summary sheet. The timings are the Access Control Policy's: [[60]] minutes for an urgent leaver, a [[5]]-working-day mover window where a handover is recorded, [[1]] working day to disable an orphaned account, and non-standard access for no more than [[6]] months. |
| 2 | Add a row on Provisioning log for every change, the day it is made. Choose the event: it decides the deadline. Enter the request or record reference, the person or account, the change, the systems and the access in the system's own words. |
| 3 | Name the source record: the HR record for an employee and the sponsor register for a non-employee (JML-01). A profile needs no further approval: record that it was approved in advance and that the line manager or sponsor confirmed it (JML-03). Non-standard access needs both approvers and an expiry (JML-04). |
| 4 | Enter who made the change. The check refuses an entry where an approver made the change (JML-05). For a joiner, enter when the accounts were created (disabled) and when they were enabled: never before the start date, and never created more than [[5]] working days before it (JML-07). |
| 5 | Enter the date the event sets: the start date, the move date, the last working day, the first day of an absence, the day an orphaned account was found, or, for an urgent leaver, the time of the decision. For a mover, say whether the old line manager recorded a handover. The deadline calculates. |
| 6 | Record the completion time and mark a removal confirmed only once you have seen it in the system (JML-14). Clear every Record check that does not say "Recorded", and follow up every Late or Overdue entry. |
| 7 | Keep the Non-standard access sheet current: every live non-standard right, its expiry and whether it was renewed or removed. The sponsor or requester is reminded [[10]] working days before expiry (JML-04, JML-10). |
| 8 | Keep the log as evidence for the period your records policy sets, and at least until the next audit. To clear the EXAMPLE, delete the contents of the Example column and of every yellow column; keep the white formula columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Nine joiners, two non-standard grants, five movers, one long absence, nine leavers and the two orphaned accounts the month-end reconciliation disabled. Three entries are late: J-06's accounts were enabled a day after the start date because HR recorded the joiner two working days before it; M-01's old access was removed on 2 Oct 2026, 17 working days after the window closed, holding the High conflict SOD-FI-01; and L-02's local warehouse system account went four working days late.
Adapting for a small organisation: the service desk's ticketing system can be the log, if every field here is a field there and removals are confirmed in the system. Keep the approvers and the maker as separate names, even when they are the only two people in IT.
Adapting for a regulated entity (NIS2, DORA): the log is the register of access rights granted and the record of their management that the Implementing Regulation (EU) 2024/2690 asks for (Annex 11.2 and 11.5), and the lifecycle record of Delegated Regulation (EU) 2024/1774 Article 20(2). Keep it for the period your records policy sets.
Adapting where a service provider runs your IT: the provider records the changes it makes here, or in a system you can read and export. Your organisation keeps the approvals and checks the provider's completion times against the deadlines each month.
Provisioning log
One row per grant, change, suspension or removal (JML-14). Yellow columns are inputs; white columns calculate. The deadline follows from the event; a removal is complete only when confirmed in the system.
| Example | Request or record reference | Event | Person or account | Change | Systems | Access, in the system's words | Source record | Approved by | Second approver or confirmation | Made by | Event date (start, move, last day, decision) | Handover recorded (mover) | Accounts created, disabled (joiner) | Deadline (calc) | Completed | Expiry (non-standard or non-employee) | Confirmed in the system | Evidence reference | Timeliness (calc) | Record check (calc) | Note |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | J-01 | LE-01 Joiner (employee) | J-01 (employee) | Grant | SYS-07, SYS-06, SYS-02 | BP-00 Base profile + RP-01 Warehouse operative | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; Warehouse systems administrator | 1 Sep 2026 | 25 Aug 2026 | 1 Sep 2026 | 1 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-02 | LE-01 Joiner (employee) | J-02 (employee) | Grant | SYS-07, SYS-06, SYS-02 | BP-00 Base profile + RP-01 Warehouse operative | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; Warehouse systems administrator | 1 Sep 2026 | 25 Aug 2026 | 1 Sep 2026 | 1 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-03 | LE-01 Joiner (employee) | J-03 (employee) | Grant | SYS-07, SYS-06, SYS-02 | BP-00 Base profile + RP-01 Warehouse operative | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; Warehouse systems administrator | 7 Sep 2026 | 31 Aug 2026 | 7 Sep 2026 | 7 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-04 | LE-01 Joiner (employee) | J-04 (employee) | Grant | SYS-07, SYS-06, SYS-01 | BP-00 Base profile + RP-03 Customer service agent | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; ERP provider | 7 Sep 2026 | 1 Sep 2026 | 7 Sep 2026 | 7 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-05 | LE-01 Joiner (employee) | J-05 (employee) | Grant | SYS-07, SYS-06, SYS-01 | BP-00 Base profile + RP-06 Sales account manager | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; ERP provider | 14 Sep 2026 | 8 Sep 2026 | 14 Sep 2026 | 14 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-06 | LE-01 Joiner (employee) | J-06 (employee) | Grant | SYS-07, SYS-06, SYS-02 | BP-00 Base profile + RP-01 Warehouse operative | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; Warehouse systems administrator | 21 Sep 2026 | 17 Sep 2026 | 21 Sep 2026 | 22 Sep 2026 | Yes | [[ticket and system log reference]] | Late | Recorded | HR recorded the joiner two working days before the start date; the handheld account was ready on the second day. | ||
| EXAMPLE | J-07 | LE-01 Joiner (employee) | J-07 (employee) | Grant | SYS-07, SYS-06, SYS-02, SYS-08, SYS-10 | BP-00 Base profile + RP-07 Transport planner | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | IT service desk; Warehouse systems administrator; Transport office administrator | 28 Sep 2026 | 21 Sep 2026 | 28 Sep 2026 | 28 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | J-08 | LE-02 Joiner (non-employee) | J-08 (agency worker) | Grant | SYS-07, SYS-06, SYS-02 | BP-00 Base profile + RP-01 Warehouse operative | Sponsor register | Profile approved in advance (JML-03) | Sponsor confirmed the profile (Warehouse 1 manager) | IT service desk; Warehouse systems administrator | 14 Sep 2026 | 9 Sep 2026 | 14 Sep 2026 | 14 Sep 2026 | 18 Dec 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||
| EXAMPLE | J-09 | LE-02 Joiner (non-employee) | J-09 (contractor) | Grant | SYS-07, SYS-06 | BP-00 Base profile | Sponsor register | Profile approved in advance (JML-03) | Sponsor confirmed the profile (Head of Logistics) | IT service desk | 21 Sep 2026 | 14 Sep 2026 | 21 Sep 2026 | 21 Sep 2026 | 29 Jan 2027 | Yes | [[ticket and system log reference]] | On time | Recorded | A business analyst for the warehouse system upgrade: the base profile and one non-standard right. | |
| EXAMPLE | NS-2026-031 | Non-standard access (JML-04) | J-05 | Grant | SYS-01 | Pricing approval report (read) | Access request and approval form | Sales Director (line manager) | Chief Financial Officer (system owner) | ERP provider (P06 SUP-004) | 14 Sep 2026 | 12 Mar 2027 | Yes | [[ticket and system log reference]] | Recorded | Checks discounts against approved price lists for key accounts | |||||
| EXAMPLE | NS-2026-033 | Non-standard access (JML-04) | J-09 | Grant | SYS-01 | Stock and purchasing reports (read) | Access request and approval form | Head of Logistics (sponsor) | Chief Financial Officer (system owner) | ERP provider (P06 SUP-004) | 21 Sep 2026 | 29 Jan 2027 | Yes | [[ticket and system log reference]] | Recorded | Analyses stock movements for the warehouse system upgrade | |||||
| EXAMPLE | M-01 | LE-03 Mover | M-01 | Grant | SYS-01, SYS-05 | RP-05 Payments officer | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | ERP provider; IT service desk | 7 Sep 2026 | No | 7 Sep 2026 | 7 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-01 | LE-03 Mover | M-01 | Remove | SYS-01, SYS-05 | RP-04 Accounts payable clerk: Supplier invoice entry; Supplier master data, including bank details; Accounts payable folder | HR record | Not needed for a removal | Not needed for a removal | ERP provider; IT service desk | 7 Sep 2026 | No | 7 Sep 2026 | 2 Oct 2026 | Yes | [[ticket and system log reference]] | Late | Recorded | The mover request added the new profile and did not remove the old one, and the conflict check looked only at the new profile. Mover requests now replace the old profile by default (JML-08), and the conflict check covers the person's resulting access (JML-06). | ||
| EXAMPLE | M-02 | LE-03 Mover | M-02 | Grant | SYS-02, SYS-08 | RP-02 Warehouse team leader | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | Warehouse systems administrator; Transport office administrator | 1 Sep 2026 | No | 1 Sep 2026 | 1 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-02 | LE-03 Mover | M-02 | Remove | SYS-02 | RP-01 Warehouse operative: Picker (handheld) | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 1 Sep 2026 | No | 1 Sep 2026 | 1 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-03 | LE-03 Mover | M-03 | Grant | SYS-01 | RP-06 Sales account manager | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | ERP provider | 14 Sep 2026 | Yes | 14 Sep 2026 | 14 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-03 | LE-03 Mover | M-03 | Remove | SYS-01 | RP-03 Customer service agent: Order entry and customer enquiry | HR record | Not needed for a removal | Not needed for a removal | ERP provider | 14 Sep 2026 | Yes | 21 Sep 2026 | 18 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-04 | LE-03 Mover | M-04 | Grant | SYS-02, SYS-08 | RP-02 Warehouse team leader | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | Warehouse systems administrator; Transport office administrator | 21 Sep 2026 | No | 21 Sep 2026 | 21 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-04 | LE-03 Mover | M-04 | Remove | SYS-02, SYS-10 | RP-07 Transport planner: Dispatch planning; Rate search user | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator; Transport office administrator | 21 Sep 2026 | No | 21 Sep 2026 | 21 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-05 | LE-03 Mover | M-05 | Grant | SYS-02, SYS-08, SYS-10 | RP-07 Transport planner | HR record | Profile approved in advance (JML-03) | Line manager confirmed the profile | Warehouse systems administrator; Transport office administrator | 28 Sep 2026 | No | 28 Sep 2026 | 28 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | M-05 | LE-03 Mover | M-05 | Remove | SYS-02 | RP-02 Warehouse team leader: Team leader: pick lists and stock moves | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 28 Sep 2026 | No | 28 Sep 2026 | 28 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | |||
| EXAMPLE | A-01 | LE-07 Long absence | A-01 | Suspend | SYS-07, SYS-06, SYS-02, SYS-08 | All accounts (parental leave, expected back 15 Mar 2027) | HR record | Not needed for a removal | Not needed for a removal | IT service desk; Warehouse systems administrator; Transport office administrator | 14 Sep 2026 | 14 Sep 2026 | 14 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-01 | LE-04 Leaver | L-01 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 4 Sep 2026 | 4 Sep 2026 | 4 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-01 | LE-04 Leaver | L-01 | Remove | SYS-02 | All access | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 4 Sep 2026 | 4 Sep 2026 | 4 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-02 | LE-04 Leaver | L-02 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 11 Sep 2026 | 11 Sep 2026 | 11 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-02 | LE-04 Leaver | L-02 | Remove | SYS-02 | All access | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 11 Sep 2026 | 11 Sep 2026 | 17 Sep 2026 | Yes | [[ticket and system log reference]] | Late | Recorded | The warehouse system removal task went to a shared site mailbox, not to the named administrator. | |||
| EXAMPLE | L-02 | LE-04 Leaver | L-02 | Remove | SYS-08 | All access | HR record | Not needed for a removal | Not needed for a removal | Transport office administrator | 11 Sep 2026 | 11 Sep 2026 | 11 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-03 | LE-04 Leaver | L-03 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 11 Sep 2026 | 11 Sep 2026 | 11 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-04 | LE-04 Leaver | L-04 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 18 Sep 2026 | 18 Sep 2026 | 18 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-04 | LE-04 Leaver | L-04 | Remove | SYS-02 | All access | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 18 Sep 2026 | 18 Sep 2026 | 18 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-05 | LE-05 Urgent or hostile leaver | L-05 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 23 Sep 2026 | 23 Sep 2026 | 23 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-06 | LE-06 Non-employee end date | L-06 | Remove | SYS-07 | All access | Sponsor register | Not needed for a removal | Not needed for a removal | IT service desk | 18 Sep 2026 | 18 Sep 2026 | 18 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-06 | LE-06 Non-employee end date | L-06 | Remove | SYS-02 | All access | Sponsor register | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 18 Sep 2026 | 18 Sep 2026 | 18 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-07 | LE-06 Non-employee end date | L-07 | Remove | SYS-07 | All access | Sponsor register | Not needed for a removal | Not needed for a removal | IT service desk | 25 Sep 2026 | 25 Sep 2026 | 25 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-08 | LE-04 Leaver | L-08 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 25 Sep 2026 | 25 Sep 2026 | 25 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-08 | LE-04 Leaver | L-08 | Remove | SYS-02 | All access | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 25 Sep 2026 | 25 Sep 2026 | 25 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-09 | LE-04 Leaver | L-09 | Remove | SYS-07 | All access | HR record | Not needed for a removal | Not needed for a removal | IT service desk | 30 Sep 2026 | 30 Sep 2026 | 30 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-09 | LE-04 Leaver | L-09 | Remove | SYS-02 | All access | HR record | Not needed for a removal | Not needed for a removal | Warehouse systems administrator | 30 Sep 2026 | 30 Sep 2026 | 30 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-09 | LE-04 Leaver | L-09 | Remove | SYS-08 | All access | HR record | Not needed for a removal | Not needed for a removal | Transport office administrator | 30 Sep 2026 | 30 Sep 2026 | 30 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | L-09 | LE-04 Leaver | L-09 | Remove | SYS-10 | All access | HR record | Not needed for a removal | Not needed for a removal | Transport office administrator | 30 Sep 2026 | 30 Sep 2026 | 30 Sep 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | O-01 | Orphaned account (JML-15) | Personal account of a transport planner who left on 26 Jun 2026, before the process was adopted | Remove | SYS-08 | Account disabled | Month-end reconciliation | Not needed for a removal | Not needed for a removal | Transport office administrator | 1 Oct 2026 | 2 Oct 2026 | 1 Oct 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | ||||
| EXAMPLE | O-02 | Orphaned account (JML-15) | Shared bookings account for Warehouse 2, set up by a former team leader, with no named owner | Remove | SYS-08 | Account disabled | Month-end reconciliation | Not needed for a removal | Not needed for a removal | Transport office administrator | 1 Oct 2026 | 2 Oct 2026 | 1 Oct 2026 | Yes | [[ticket and system log reference]] | On time | Recorded | Replaced by personal booking accounts for the two team leaders who used it (JML-02). |
Non-standard access
Every live non-standard right: what is outside the person's profiles, with its approvers and expiry (JML-04). At expiry it is removed unless the same approvers renewed it beforehand. The EXAMPLE shows the rights granted in September.
| Example | Request reference | Person | System | Access right | Business reason | Line manager or sponsor | System or data owner | Granted | Expiry | Remind on (calc) | Renewed to (new expiry) | Removed on | Status (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | NS-2026-031 | J-05 | SYS-01 | Pricing approval report (read) | Checks discounts against approved price lists for key accounts | Sales Director (line manager) | Chief Financial Officer (system owner) | 14 Sep 2026 | 12 Mar 2027 | 26 Feb 2027 | Live | ||
| EXAMPLE | NS-2026-033 | J-09 | SYS-01 | Stock and purchasing reports (read) | Analyses stock movements for the warehouse system upgrade | Head of Logistics (sponsor) | Chief Financial Officer (system owner) | 21 Sep 2026 | 29 Jan 2027 | 15 Jan 2027 | Live |
Event rules
Lifecycle events, approvals and evidence
The events that start a change, where each comes from and the deadline it sets, from the Joiner-Mover-Leaver Operating Procedure; who approves what; and the evidence each rule leaves.
Lifecycle events
| Event | Source | Trigger | Deadline | Rules |
|---|---|---|---|---|
| LE-01 Joiner (employee) | HR record | HR records the start date, job, department and line manager | Accounts created disabled no earlier than [[5]] working days before the start date, base and role profile ready, enabled on the start date | JML-01, JML-03, JML-07 |
| LE-02 Joiner (non-employee) | Sponsor register | The sponsor records the person, the reason and the end date | As an employee joiner; the account expires automatically at the end date, no more than [[12]] months ahead | JML-01, JML-07, JML-10 |
| LE-03 Mover | HR record | HR records a new job, department or line manager, with the move date | New role's profile from the move date; old role's access removed on the move date, or within [[5]] working days where a handover is recorded | JML-03, JML-06, JML-08 |
| LE-04 Leaver | HR record or sponsor register | HR records the last working day, or the sponsor ends the engagement | All access removed by the end of the last working day; equipment and tokens recovered the same day | JML-09 |
| LE-05 Urgent or hostile leaver | HR record | HR or the line manager decides the person leaves now, or is suspended | All access removed within [[60]] minutes of the decision, and before the person is told | JML-09 |
| LE-06 Non-employee end date | Sponsor register | The recorded end date arrives, or the sponsor ends the engagement early | The account expires automatically at the end of the end date; an early end is a leaver the same day | JML-10 |
| LE-07 Long absence | HR record | HR records an absence expected to last more than [[30]] days | Accounts suspended from the first day of the absence; restored on the day of return, once the line manager confirms it | JML-11 |
Two further entries use the log without a lifecycle event: Non-standard access (JML-04), granted on an approved request with an expiry, and Orphaned account (JML-15), disabled within [[1]] working day of the reconciliation finding it.
Who approves what
| Request | Approvers | Rule | ||
|---|---|---|---|---|
| Base and role profile, for a joiner or a mover | None beyond the HR record: the profile is approved in advance by its owner and the owner of each system in it. The line manager confirms which profile applies. | JML-03 | ||
| Non-standard access | The line manager (or the sponsor), and the owner of the system or data. With an expiry no more than [[6]] months ahead. | JML-04 | ||
| Renewal of non-standard access, or extension of a non-employee's end date | The same approvers as the original request, before the expiry or end date. | JML-04 | ||
| Access that would create a segregation-of-duties conflict | Not granted unless accepted as an exception under P02 SD-04, approved at the level P02 sets for the exception's band. At Critical that is the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. | JML-06 | ||
| An exception to the Access Control Policy | Through the P02 exception process, approved at the level P02 sets for the band. At Critical, the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. | P02 EX-05 | ||
| Privileged, emergency or service account access | As the Privileged Access Standard sets. | JML-16 | ||
The evidence each rule leaves
| Rule | Evidence | Kept for | ||
|---|---|---|---|---|
| JML-01 | HR record or sponsor register entry for the event, with its date | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-04 | The approved request for non-standard access, with its expiry | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-06 | The segregation-of-duties check for each grant, kept as P02 SD-07 sets | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-14 | The access provisioning log entry for every grant, change, suspension and removal | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-09 | The completed leaver checklist for every leaver, with the time of each removal | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-13 | The reset ticket, with the identity check used | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-12 | The discovery results and the outcome for each system found | [[the period your records policy sets, and at least until the next audit]] | ||
| JML-15 | The monthly reconciliation and report, with the findings raised | [[the period your records policy sets, and at least until the next audit]] | ||
Summary
Summary: the month by event
Calculated from the Provisioning log and the Non-standard access sheet. Late and overdue entries are followed up with the system owner; late leavers, residual access and orphaned accounts go to the access review as findings (JML-15).
Settings
| Setting | Value | Note | ||||
|---|---|---|---|---|---|---|
| As-at date | 30 Sep 2026 | EXAMPLE: the month end. Open entries past their deadline show as Overdue. | ||||
| Minutes allowed for an urgent leaver (JML-09) | 60 | [[60]] | ||||
| Mover window with a handover, working days (JML-08) | 5 | [[5]]; without a handover the old access goes on the move date | ||||
| Working days to disable an orphaned account (JML-15) | 1 | [[1]] | ||||
| Longest expiry for non-standard access, months (JML-04) | 6 | [[6]] | ||||
| Reminder before an expiry, working days (JML-04, JML-10) | 10 | [[10]] | ||||
| Earliest account creation before a start date, working days (JML-07) | 5 | [[5]] | ||||
Entries by event
| Event | Entries | On time | Late | Open | Overdue | Record checks to clear |
|---|---|---|---|---|---|---|
| LE-01 Joiner (employee) | 7 | 6 | 1 | 0 | 0 | 0 |
| LE-02 Joiner (non-employee) | 2 | 2 | 0 | 0 | 0 | 0 |
| LE-03 Mover | 10 | 9 | 1 | 0 | 0 | 0 |
| LE-04 Leaver | 14 | 13 | 1 | 0 | 0 | 0 |
| LE-05 Urgent or hostile leaver | 1 | 1 | 0 | 0 | 0 | 0 |
| LE-06 Non-employee end date | 3 | 3 | 0 | 0 | 0 | 0 |
| LE-07 Long absence | 1 | 1 | 0 | 0 | 0 | 0 |
| Non-standard access (JML-04) | 2 | 0 | 0 | 0 | 0 | 0 |
| Orphaned account (JML-15) | 2 | 2 | 0 | 0 | 0 | 0 |
| All entries | 42 | 37 | 3 | 0 | 0 | 0 |
JMM-04 Non-standard access past expiry
| Figure | Value | Note | ||||
|---|---|---|---|---|---|---|
| Live non-standard rights at the period end (from the full extract) | 17 | EXAMPLE: every live right in the provisioning records, not only those on the Non-standard access sheet: 15 recorded at adoption or granted in July and August, and the 2 September grants. | ||||
| Past expiry, neither removed nor renewed (calc) | 0 | Counted on the Non-standard access sheet. | ||||
| JMM-04 (calc) | 0 of 17 live | Non-standard access rights past their expiry date at the period end, neither removed nor renewed. | ||||
The late entries and what was done (EXAMPLE)
| Entry | What happened and what was done | |||||
|---|---|---|---|---|---|---|
| J-06 joiner enabled a day late | HR recorded the joiner two working days before the start date; the handheld account was ready on the second day. | |||||
| M-01 old access kept after the move | Supplier invoice entry (SYS-01); Supplier master data, including bank details (SYS-01); Accounts payable folder (SYS-05): held for 17 working days after the window closed, both sides of SOD-FI-01. The Financial Controller checked every change to supplier bank details since 7 Sep: none was made by the mover. The mover request added the new profile and did not remove the old one, and the conflict check looked only at the new profile. Mover requests now replace the old profile by default (JML-08), and the conflict check covers the person's resulting access (JML-06). | |||||
| L-02 local warehouse system account | The warehouse system's log shows no sign-in to the account after the last working day, and the badge was recovered on the day. The warehouse system removal task went to a shared site mailbox, not to the named administrator. Recorded against P07 PW-01 (HR Director, due 30 Nov 2026), which stays open. The leaver checklist now sends the warehouse system line to the named administrator. | |||||
Rules
Rules this workbook applies
The rules come from the Access Control Policy and keep their IDs across the pack. Change a rule there, never here: this sheet quotes it.
| Rule | Requirement | Where this workbook applies it |
|---|---|---|
| JML-01 | Every employee's account is created, changed, suspended and removed only from an event in the HR record, and every non-employee's only from the sponsor register. No account is created on a manager's request alone, and no account exists without a record in one or the other. | Provisioning log: the source record of every entry. |
| JML-03 | Joiners and movers receive the base profile and their role profile without further approval. Each role profile has a named owner, is approved by the owner of every system in it, never contains a segregation-of-duties conflict or privileged access, and is reviewed every [[12]] months and after a reorganisation or a new core system. | Provisioning log: a profile is approved in advance; the line manager or sponsor confirms which applies. |
| JML-04 | Access outside the person's profiles is non-standard. It needs a business reason, approval by the line manager (or the sponsor) and by the owner of the system or data, and an expiry date no more than [[6]] months ahead, or the non-employee's end date if that is sooner. At expiry it is removed unless the same approvers renewed it beforehand, with a new expiry date. | Provisioning log and Non-standard access: both approvers, an expiry within the maximum, the reminder and the removal at expiry. |
| JML-05 | Nobody approves their own access, or the access of anyone who approves theirs. The person who makes the change in a system does not approve it (P02 SOD-IT-01). | Provisioning log: the Record check refuses an entry made by its own approver. |
| JML-07 | HR records a joiner at least [[5]] working days before the start date. Accounts are created disabled no earlier than [[5]] working days before it and enabled on the start date, never before. The first password or sign-in set-up is given only to the joiner, in person or through a channel checked against the HR record. | Provisioning log: a joiner's accounts created no earlier than allowed and enabled on the start date, never before. |
| JML-08 | A mover receives the new role's profile from the move date. The old role's access is removed on the move date or, where the old line manager records a handover, no later than [[5]] working days after it. Access still needed after that is requested as non-standard (JML-04). | Provisioning log: a mover's old access removed by the end of the window. |
| JML-09 | A leaver's access is removed from every system, including local accounts outside single sign-on, by the end of their last working day. For an urgent leaver it is removed within [[60]] minutes of the decision, and before the person is told. Equipment, badges, tokens and shared credentials are recovered or changed the same day, using the leaver checklist. Removed accounts are deleted after [[90]] days, once their data has been dealt with. | Provisioning log: a leaver's removals by the end of the last working day, an urgent leaver's within the minutes allowed. |
| JML-11 | The accounts of a person on a long absence (more than [[30]] days) are suspended from the first day of the absence, and restored on the day they return once the line manager confirms it. HR and the line manager may record a reason to keep a named access right during the absence. | Provisioning log: a long absence suspends the accounts from its first day. |
| JML-14 | Every grant, change, suspension and removal is recorded in the access provisioning log with its request reference, the approvers, who made the change and when it was completed. A removal is recorded as complete only when it is confirmed in the system. | Provisioning log: every change recorded, a removal only once confirmed in the system. |
| JML-15 | Within [[3]] working days of each month end, every in-scope system's accounts are reconciled with the HR record and the sponsor register. An orphaned account is disabled within [[1]] working day of being found. Every late leaver, mover with residual access and orphaned account is raised as a finding with the access review coordinator (P07 AR-08), and a pattern goes to the process owner as a process weakness (P07 AR-11). | Provisioning log: an orphaned account disabled within the working day allowed. |
| JML-16 | Privileged access, including administrator, emergency ("break-glass") and service accounts, follows the Privileged Access Standard of the Privileged Access Management pack. This pack sets no rule for it and puts no privileged access in a role profile. A leaver or mover who holds privileged access is handled by this pack's process, with the privileged steps the Privileged Access Standard sets. | Privileged changes follow the Privileged Access Standard; record them in its own records. |
Lists
| Event | Change | Source | YesNo |
|---|---|---|---|
| LE-01 Joiner (employee) | Grant | HR record | Yes |
| LE-02 Joiner (non-employee) | Change | Sponsor register | No |
| LE-03 Mover | Suspend | Access request and approval form | |
| LE-04 Leaver | Restore | Month-end reconciliation | |
| LE-05 Urgent or hostile leaver | Remove |
LE-06 Non-employee end date
LE-07 Long absence
Non-standard access (JML-04)
Orphaned account (JML-15)
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Access provisioning log | The record of every grant, change, suspension and removal of access, kept as JML-14 sets. |
| Joiner | A new employee or non-employee who needs access from a start date. |
| Mover | A person whose job, department or line manager changes. Their new role's access is added and their old role's access is removed. |
| Leaver | A person whose employment or engagement ends. All their access is removed, and everything they hold is recovered. |
| Urgent leaver | A leaver who leaves at short notice or on bad terms: a dismissal, a resignation with immediate effect, a suspension, or a leaver suspected of misconduct. Also called a hostile leaver. |
| Long absence | An absence expected to last more than [[30]] days, such as parental leave, long sick leave, a sabbatical or a suspension. |
| Non-standard access | Any access right that is not in the person's base or role profile. Needs its own approval and an expiry date. |
| HR record | The HR system's record of each employee: start date, job, department, line manager, absence and leaving date. The only source for an employee's lifecycle events. |
| Sponsor register | The record of every non-employee who uses the organisation's systems: who they are, who sponsors them, why, and the end date. Kept by [[HR, or the service desk where HR does not hold non-employees]]. The only source for a non-employee's lifecycle events. |
| Suspend | To disable an account so it cannot be used, keeping it and its access rights so they can be restored. |
| Remove | To disable an account or withdraw an access right so it can no longer be used. A removed account is deleted later, once its data has been dealt with. |
| Orphaned account | An account that matches no current person in the HR record or the sponsor register, or a shared account with no named owner. P07 calls it an orphan account. |
| Move date | The date a mover starts their new job, from the HR record. |
| Deadline | The latest the change may be completed, from the event and its date: the start date for a joiner, the end of the mover window, the last working day for a leaver, [[60]] minutes after the decision for an urgent leaver, and the working day after an orphaned account is found. |
| Timeliness | On time or Late against the deadline; Open before it with no completion; Overdue after it with no completion; Enabled early (JML-07) for a joiner enabled before the start date. |
| Confirmed in the system | Seen in the system itself, from its user list, audit log or the account's status, not from the ticket (JML-14). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.18 — Access rights | Provisioning log: access provided, changed and removed with approval, and recorded |
| NIST CSF 2.0 | PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties” | The whole log: permissions granted and removed as approved, with separation of duties between approver and maker |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 11.2 — access rights are provided, modified, removed and documented under the access control policy: assigned and revoked on need-to-know, least privilege and separation of duties; “modified accordingly upon termination or change of employment”; authorised by the relevant persons; third-party access limited in scope and in duration; a register of access rights granted; logging of the management of access rights; and review at planned intervals | Provisioning log: rights provided, modified and removed and documented, a register of rights granted, and the management of rights logged |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 11.5 — “manage the full life cycle of identities of network and information systems and their users”: unique identities, each user identity linked to a single person, shared identities only where necessary and explicitly approved and documented, logging of identity management, and regular review, deactivating identities no longer needed “without delay” | Provisioning log: identities and accounts managed through their life cycle, and deactivated without delay when no longer needed |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 20(2) — a unique identity and user account for each staff member, and for each member of an ICT third-party service provider's staff, with records of identity assignments kept after a reorganisation or the end of the contract; and “a lifecycle management process for identities and accounts managing the creation, change, review and update, temporary deactivation, and termination of all accounts”, automated where feasible and appropriate | Provisioning log: the creation, change, temporary deactivation and termination of every account recorded (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others | Provisioning log and Non-standard access: rights withdrawn without undue delay, and non-standard access removed at expiry |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.