Access review scope: what's in, what's out?

Not every user, not every system needs to be included in every review. Here's how to define your scope so it stays manageable — and defensible in an audit.

Defining review scope is the first step of the review process. Get it wrong here and you'll either drown in unnecessary work — or miss something critical.

People within scope

\n
• Active employees: always.
\n
• Scheduled to start: not yet active, not in scope yet.
\n
• Scheduled to leave: in scope — final check before departure.
\n
• Inactive since the previous review: in scope one more time to verify that access has genuinely been revoked.
\n
• Contractors and external parties: a separate review track with its own cadence (typically monthly).
\n

Systems within scope

\n
• All tier-1 (critical) systems: always.
\n
• Tier-2: included in every standard review.
\n
• Tier-3 (nice-to-have SaaS): every six months, unless there is a specific reason to review sooner.
\n

Document your scope decisions

Record your scope policy in your ISMS. For each review, keep a scope snapshot that captures exactly what was included. This allows an auditor to compare across reviews and confirm that you are applying your scope consistently.

See also: sample-based or full review, SaaS inventory.