Access Review Scope & System Inventory

Establishes which systems are in scope, who owns each, and how entitlement data is extracted — the step whose absence derails most first campaigns.

Available soon

Format: Excel
Size: 86 KB
Length: 10 sheets
Version: 1.0
Updated: 28 Sep 2026

What's inside

Instructions
Inventory
Extract Readiness
Summary
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30; replace it with today's date, or type =TODAY() to keep it current. Review status and days past due are measured against it.
2	Add one row per system that holds or gives access to information you must protect (AR-01): every in-scope system must have a named system owner and a documented way to extract who has access. Give each a System ID (SYS-01, SYS-02 …) that never changes, and name the system owner: [[the manager accountable for the system]]. Start with the systems behind your critical services and every system with administrator access; add the rest as you find them.
3	Choose each system's Review scope from the list. Review every calculates from it (privileged and administrator access, all systems: every 3 months; systems supporting a critical service: every 6 months; all other in-scope systems: every 12 months; Access must be reviewed at least as often as its scope requires (FREQUENCY), AR-02). A system with both administrator and ordinary access needs two rows, or one row reviewed at the shorter interval: administrator access is reviewed every 3 months on every system.
4	Record the kinds of account on the system besides personal accounts, using the account types reviewers see in the extract: privileged (administrator), generic or shared, service (used by software, not a person), and third-party (a supplier's staff). Privileged, generic and service accounts must each have a named owner and must be reviewed by the system owner and information security. (AR-06)
5	Describe how the list of who has access is extracted: the method, who runs it, the format, and whether it gives each field a reviewer needs (AR-03): name, role, permissions and last sign-in. If a field is missing, find where it comes from (the directory usually has last sign-in) before the campaign, not during it.
6	Test every extract before the campaign's extract date on the Extract Readiness sheet: count the entries, reconcile them with the count the system itself shows, and answer the checks. Enter the test date and result (OK or Issue) here. A system whose extract is not Ready is not ready for review.
7	After each campaign, enter the Last review date (the campaign's close date) and the campaign ID. Next review due and Review status calculate: In date; Due soon (due within 30 calendar days, the time a campaign takes to run); Overdue; Never reviewed. Plan the next campaign from the earliest due date on the Summary sheet.
8	Link each system to the other registers: the supplier that runs or supports it (P06 Supplier Security Risk Register, SUP-nnn) and any risk it carries (P05 Information Security Risk Register, R-nn). Clear every Record check that does not say OK.
9	Delete the EXAMPLE rows on the Inventory and Extract Readiness sheets before the inventory is approved. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its five in-scope systems were all last reviewed in campaign UAR-2026-Q3 (extract 2026-09-01, closed 2026-09-29), so all five are In date as at 2026-09-30: ARM-01 is 5 of 5. The ERP (SYS-01) is hosted by the P06 ERP provider, SUP-004, whose support desk runs the extract; the directory administrator groups (SYS-03) carry P05 risk R-07, administrator misuse of privileged access.

Tailoring — small organisation: start with fewer rows, not fewer columns. The directory administrator groups, the finance system and the system your customers use are usually enough for a first campaign; add the others at the next. An extract that is a screenshot of a user list is acceptable if it is dated and shows every field.

Tailoring — regulated entity: NIS2 Art 21(2)(i) expects access control policies and asset management; this inventory is the asset list for access review. DORA Art 9(4)(c) and Delegated Regulation (EU) 2024/1774 Art 21(e) require access rights to be reviewed at least every six months for ICT systems supporting critical or important functions and at least yearly for the others; Art 21(c) limits generic and shared accounts and requires users to be identifiable. Mark those systems with the second scope. PCI DSS 7.2.4 expects user accounts and their privileges, including third-party accounts, to be reviewed at least every six months; 7.2.5.1 expects application and system accounts to be reviewed at a frequency set by a targeted risk analysis; 8.2.6 expects accounts inactive for 90 days to be removed or disabled. Give each system in the cardholder data environment the second scope and record its service accounts.

Tailoring — IT run by a service provider: the provider usually runs the extracts. Name it in Extract run by, agree the lead time in working days on the Extract Readiness sheet, and make the extract a contract deliverable. The system owner and the decisions stay with you. Link the system to the provider's row in the P06 Supplier Security Risk Register.

Scopes and their frequencies are on the Lists sheet, from the Access Review Methodology. If your methodology sets shorter intervals, change them there and nowhere else. A system you decide not to review is a P02 exception, recorded in the Security Exception Register.

Inventory

One row per in-scope system (AR-01). Yellow columns are inputs; white columns calculate. Every colour sits beside a word.

Example	System ID	System	System owner	Business service supported	Review scope	Review every (months)	Privileged accounts	Generic or shared accounts	Service accounts	Third-party accounts	Each privileged, generic or service account has a named owner (AR-06)	Extract method	Extract run by	Extract format	Gives name	Gives role	Gives permissions	Gives last sign-in	Extract tested on	Extract test result	Last review	Last campaign	Next review due	Review status	Linked supplier (P06)	Linked risk (P05)	Record check
EXAMPLE	SYS-01	ERP (hosted; P06 SUP-004)	Chief Financial Officer	Finance and payroll; Warehouse dispatch	Systems supporting a critical service (or a critical or important function, DORA; or cardholder data, PCI DSS)	6	Yes	No	Yes	Yes	Yes	Supplier-run user report, requested by ticket	The provider's support desk (P06 SUP-004)	CSV file	Yes	Yes	Yes	Yes	1 Sep 2026	OK	29 Sep 2026	UAR-2026-Q3	29 Mar 2027	In date	SUP-004		OK
EXAMPLE	SYS-02	Warehouse management system	Head of Logistics	Warehouse dispatch	Systems supporting a critical service (or a critical or important function, DORA; or cardholder data, PCI DSS)	6	Yes	Yes	No	Yes	Yes	Admin console export	IT operations	Spreadsheet export	Yes	Yes	Yes	Yes	1 Sep 2026	OK	29 Sep 2026	UAR-2026-Q3	29 Mar 2027	In date	SUP-010		OK
EXAMPLE	SYS-03	Directory administrator groups	Head of IT	All services (directory)	Privileged and administrator access, all systems	3	Yes	No	Yes	Yes	Yes	Group membership export	IT operations	CSV file	Yes	Yes	Yes	Yes	1 Sep 2026	OK	29 Sep 2026	UAR-2026-Q3	29 Dec 2026	In date	SUP-001; SUP-006	R-07	OK
EXAMPLE	SYS-04	Online ordering admin console	Chief Operating Officer	Online ordering	Privileged and administrator access, all systems	3	Yes	No	No	No	Yes	Admin console export	Online ordering team	CSV file	Yes	Yes	Yes	Yes	1 Sep 2026	OK	29 Sep 2026	UAR-2026-Q3	29 Dec 2026	In date			OK
EXAMPLE	SYS-05	Shared finance drive	Chief Financial Officer	Finance and payroll	All other in-scope systems	12	No	No	No	No	N/A	Permissions report	IT operations	Spreadsheet export	Yes	Yes	Yes	Yes	1 Sep 2026	OK	29 Sep 2026	UAR-2026-Q3	29 Sep 2027	In date			OK

Extract Readiness

Can we get a complete list of who has access, per system? Test each extract before the campaign's extract date: the step whose absence derails most first campaigns.

Example	System ID	System	Extract method	Run by	Lead time (working days)	Entries in the extract	Control count shown by the system	Counts reconcile	Fields reviewers need (AR-03)	Every account included	Third-party accounts included	Accounts can be matched to people	Permissions readable by a reviewer	Dated and kept unchanged	Extract tested on	Readiness	What was done to make it usable
EXAMPLE	SYS-01	ERP (hosted; P06 SUP-004)	Supplier-run user report, requested by ticket	The provider's support desk (P06 SUP-004)	5	164	164	Yes	4 of 4	Yes	Yes	Yes	Yes	Yes	1 Sep 2026	Ready	Requested from the provider by ticket 5 working days before the extract date. The report gives role codes: the finance team's role catalogue translates them for reviewers.
EXAMPLE	SYS-02	Warehouse management system	Admin console export	IT operations	1	212	212	Yes	4 of 4	Yes	Yes	Yes	Yes	Yes	1 Sep 2026	Ready	The admin console export includes the handheld scanner accounts (generic); each has a named owner, the shift manager.
EXAMPLE	SYS-03	Directory administrator groups	Group membership export	IT operations	1	14	14	Yes	4 of 4	Yes	Yes	Yes	Yes	Yes	1 Sep 2026	Ready	Membership of every administrator group, with nested groups expanded to people; the service accounts are listed with their owners.
EXAMPLE	SYS-04	Online ordering admin console	Admin console export	Online ordering team	1	9	9	Yes	4 of 4	Yes	N/A	Yes	Yes	Yes	1 Sep 2026	Ready	Console accounts are local, not in the directory: they are matched to people by email address. This is how the orphan account was found.
EXAMPLE	SYS-05	Shared finance drive	Permissions report	IT operations	1	96	96	Yes	4 of 4	Yes	N/A	Yes	Yes	Yes	1 Sep 2026	Ready	The permissions report lists groups: they are expanded to people with the directory's group export, and last sign-in is taken from the directory.

Summary

Inventory summary

Every figure is calculated from the Inventory and Extract Readiness sheets as at the date below. Use them to plan the next campaign and for the campaign report (AR-12).

As-at date	30 Sep 2026	EXAMPLE date. Replace it with today's date, or type =TODAY().
Due soon: calendar days before the due date	30	At least the time a campaign takes (the EXAMPLE campaign ran 28 calendar days from extract to close).

Headline measure

Measure	Result	Target	Status	What it means
ARM-01 Reviews on time	5 of 5	All	On target	In-scope systems reviewed within their frequency, out of all in-scope systems. Due soon counts as on time; Overdue and Never reviewed do not. Access must be reviewed at least as often as its scope requires (FREQUENCY).

Systems by review scope

Review scope	Review every (months)	Systems	In date	Due soon	Overdue	Never reviewed	Why this interval
Privileged and administrator access, all systems	3	2	2	0	0	0	The access that can do most harm, and changes most often.
Systems supporting a critical service (or a critical or important function, DORA; or cardholder data, PCI DSS)	6	2	2	0	0	0	Regulated minimum for these systems.
All other in-scope systems	12	1	1	0	0	0	Regulated minimum for all other systems.
All scopes		5	5	0	0	0
No scope chosen yet		0					Choose a scope: until then the system has no review interval.

Next campaign

Item	Value	Note
Earliest next review due	29 Dec 2026	Plan the next campaign's extract date at least the due-soon window before this date.
System due first	SYS-03	Its System ID on the Inventory sheet. Where several share the date, the first in the list.
Systems whose extract is Ready	5 of 5	From the Extract Readiness sheet. Every system should be Ready before the extract date.
Longest extract lead time (working days)	5	Request extracts at least this many working days before the extract date.

Account types to review twice (AR-06)

Systems with	Systems	Note
Privileged accounts	4	Reviewed by the system owner and information security (AR-06), every 3 months.
Generic or shared accounts	1	Each needs a named owner (AR-06).
Service accounts	2	Each needs a named owner (AR-06).
Third-party accounts	3	Supplier and contractor accounts are reviewed like any other; link the supplier's row in the P06 Supplier Security Risk Register.
Accounts without a named owner	0	Rows whose first open record check is a missing account owner.

Record checks to resolve

Check	Systems
Name the system owner (AR-01)	0
Choose the review scope (AR-02)	0
Record how access is extracted (AR-01)	0
Extract lacks a field reviewers need (AR-03)	0
Test the extract before the campaign	0
Fix the extract issue	0
Name an owner for each privileged, generic or service account (AR-06)	0
Review overdue (AR-02)	0
Never reviewed: schedule it (AR-02)	0
All rows with a check to resolve	0

Each row shows only its first unresolved check; clear it and the next one, if any, appears.

Lists

Scope	ScopeMonths	YesNo	YesNoNA	TestResult	ReviewStatus
Privileged and administrator access, all systems	3	Yes	Yes	OK	In date
Systems supporting a critical service (or a critical or important function, DORA; or cardholder data, PCI DSS)	6	No	No	Issue	Due soon
All other in-scope systems	12		N/A		Overdue

Never reviewed

Definitions

Definitions

Term	Meaning in this workbook
System	An application, platform, directory group or file store that grants access to information. Each has one row and one owner.
System ID	Your unique reference for the system, such as SYS-01. It stays the same while the system is in the inventory.
System owner	[[the manager accountable for the system]]. Decides which permissions are right for each job and signs off the system's review (AR-01, AR-06).
Business service	The service the organisation provides that depends on the system, such as online ordering or payroll.
Review scope	Privileged and administrator access, all systems: every 3 months. Systems supporting a critical service (or a critical or important function, DORA; or cardholder data, PCI DSS): every 6 months. All other in-scope systems: every 12 months.
Privileged account	An account that can change the system, its security settings or other people's access, such as an administrator.
Personal account	An account used by one named person for their own work. Every system has them, so there is no column for them.
Generic or shared account	An account not tied to one person, such as a shared login or a device account. Each needs a named owner (AR-06).
Service account	An account used by software or an integration, not by a person. Each needs a named owner (AR-06).
Third-party account	An account used by a supplier's staff, such as the provider's support desk. In the extract their employment status is Third party.
No match in HR	The employment status an extract shows for an account that matches nobody in HR records: an orphan account unless a named owner explains it.
Entitlement	What an account is allowed to do on a system: its roles, groups and permissions.
Extract	The list of every account on a system with its entitlements, taken on a stated date for review (AR-03).
Control count	The number of accounts the system itself reports, such as its user or licence count. The extract must reconcile to it.
Counts reconcile	The number of entries in the extract equals the control count. A difference means the extract is incomplete: find out why before anyone reviews it.
Check: every account included	The extract lists every account, enabled and disabled, of every type: personal, privileged, generic or shared, service and third-party, including local accounts not in the directory.
Check: third-party accounts included	Supplier and contractor accounts are in the extract and marked as such (N/A where there are none).
Check: accounts can be matched to people	Each account carries an identifier (employee number or email address) that matches the HR list or a named owner, so its employment status shows, and leavers, third parties and accounts with no match in HR stand out.
Check: permissions readable by a reviewer	Permissions are shown as roles or in business terms, or a translation of the codes is attached, so a line manager can decide.
Check: dated and kept unchanged	The file is saved as received, named with the system, the extract date and who ran it, before anyone edits a copy (AR-03, AR-10).
Last sign-in	The date the account last signed in. Reviewers use it to find dormant accounts.
Dormant account	An account that has not signed in for [[90]] days (the quality check in the methodology).
Orphan account	An account that cannot be matched to a current person or a named owner.
Lead time	Working days (Monday to Friday, excluding public holidays) between asking for an extract and receiving it.
Next review due	Last review plus the scope's interval. Blank until the system has been reviewed once.
Review status	In date: next review due more than the due-soon window away. Due soon: due within the window (30 calendar days by default). Overdue: the due date has passed. Never reviewed: no review recorded.
Readiness	Ready when the counts reconcile, the extract gives all 4 fields, every check is answered with no No, and the extract has been tested.
Record check	A calculated prompt showing the first missing or inconsistent item on the row. OK means nothing is outstanding.
As-at date	The date review status is measured against. Set on the Summary sheet.
EXAMPLE row	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete before approval.
AR-nn, ARM-nn	Rule and measure numbers in the Access Review Methodology.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.9 — Inventory of information and other associated assets	Inventory sheet: the systems that hold information, each with an owner and the service it supports
ISO/IEC 27001:2022	Annex A 5.18 — Access rights	Review scope, Review every, Last review, Next review due and Review status: access rights reviewed at planned intervals
ISO/IEC 27001:2022	Annex A 5.16 — Identity management	Extract Readiness sheet: accounts matched to people, and generic, service and third-party accounts identified with an owner
NIST CSF 2.0	ID.AM-02 — “Inventories of software, services, and systems managed by the organization are maintained”	Inventory sheet: the inventory of systems, maintained with its owners and linked supplier
NIST CSF 2.0	PR.AA-05 — “Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties”	Scope, frequency and status: access permissions reviewed; ARM-01 on the Summary sheet
DORA — Delegated Regulation (EU) 2024/1774	Article 21(e) — account management: roles for granting, reviewing and revoking access; privileged access on a need-to-use basis; removal without undue delay; review at least every six months for systems supporting critical or important functions and at least yearly for others	Review scope list: six-monthly review for systems supporting critical or important functions and yearly for others; privileged access reviewed separately
PCI DSS v4.0.1	Requirement 7.2.4 — user accounts and their access privileges, including third-party accounts, reviewed at least every six months	Third-party accounts column and the six-monthly scope for systems in the cardholder data environment

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Delegated Regulation (EU) 2024/1774; PCI DSS v4.0.1