Periodieke access reviews — van Excel naar audit-klaar
Waarom, hoe vaak, door wie en met welk bewijs. Reviews zijn het saaiste deel van toegangsbeheer — en tegelijk wat de meeste ISO-punten oplevert.
Alle artikelen in deze categorie
9 artikelenReviewing service accounts — the invisible majority
Alongside real employees, you have service accounts: API integrations, scheduled jobs, automation. Often there are more of these than human users. Who owns them, and how do you review them?
Access reviewsReviewing the Global Admin role: the highest-risk category
If there is one category where review discipline is absolutely critical, it's Global Admin and equivalent roles. Here is the dedicated procedure that sits on top of your standard access review.
Access reviewsDealing with "former employees" in your review — the cleanup round
Your first review turns up 8 accounts belonging to people who left years ago. That's not a problem — that's progress. Here's how to handle it without it turning into a blame session.
Access reviewsAccess review scope: what's in, what's out?
Not every user, not every system needs to be included in every review. Here's how to define your scope so it stays manageable — and defensible in an audit.
Access reviewsBulk decisions in access reviews: faster without being careless
80% of the rows in a review are routine. You want to handle those in a single click. How do you do that without accidentally missing a critical row?
Access reviewsEvidence for access reviews: what to keep and where
A review without evidence is, as far as an auditor is concerned, a review that never happened. Here's what to retain, in what format, and for how long.
Access reviewsGetting managers involved in access reviews without pushback
A security officer can't assess who should have access to sales tools — that's the sales manager's call. Here's how to make it a natural part of their workflow instead of a yearly headache.
Access reviewsSample-based or full access review: what does the auditor accept?
At larger scale, a full review becomes unworkable. Risk-based sampling is the answer — provided you can clearly explain how you sampled.
Access reviewsQuarterly cadence for access reviews: planning and rhythm
Four reviews a year sounds like a lot. In practice, a well-structured approach takes just 3–4 hours per quarter. Here's the cadence that works for a 40-person SMB.