Access Compliance Review Checklist

1. Purpose

The Access Compliance Review Checklist provides a structured process for reviewing whether access to organizational information, systems, applications, cloud environments, databases, and other resources is:

Authorized
Appropriate for the user’s role
Limited to business need
Consistent with least privilege
Properly approved
Protected by appropriate authentication
Periodically reviewed
Removed when no longer required
Supported by evidence

The checklist can be used for periodic access reviews, compliance monitoring, internal audits, customer assessments, and ISO/IEC 27001 readiness activities.

Core Principle

Identify Access → Verify Ownership → Validate Authorization → Review Privilege → Test Authentication → Check Activity → Remove Excess Access → Record → Approve → Monitor

2. Scope

This checklist may cover:

Employee access
Contractor access
Temporary access
Privileged access
Administrative access
Cloud access
SaaS applications
Production systems
Databases
Source-code repositories
VPN/remote access
APIs and service accounts
Supplier/third-party access
Physical access where relevant
Emergency access

3. Review Information

Field	Details
Review ID
Review Period
Review Date
Reviewer
Access Owner
System Owner
Business Owner
Security Reviewer
Systems Reviewed
Review Frequency
Overall Status
Next Review Date

4. Access Review Status

Use the following status:

☐ Appropriate
☐ Excess Access
☐ Unauthorized
☐ Access Requires Modification
☐ Access Requires Removal
☐ Evidence Required
☐ Exception Approved
☐ Not Applicable

5. Access Inventory

Verify that relevant access sources are identified.

☐ Corporate identity provider
☐ Active Directory/Entra ID where applicable
☐ Cloud platforms
☐ SaaS applications
☐ Production systems
☐ Databases
☐ Source-code repositories
☐ CI/CD platforms
☐ VPN/remote access
☐ Security tools
☐ Monitoring platforms
☐ HR systems
☐ Finance systems
☐ Customer systems
☐ Supplier systems
☐ Physical access systems where applicable

6. User Access Inventory

Maintain a current list of users with access.

User	Department	Role	System	Access Level	Owner	Status

Verify:

☐ User identity confirmed
☐ Employment/engagement status confirmed
☐ Business role confirmed
☐ System access identified
☐ Access level identified
☐ Access owner identified

7. Access Authorization

For sampled users, verify:

☐ Access was formally requested
☐ Business justification exists
☐ Appropriate approval obtained
☐ Correct system identified
☐ Correct access level approved
☐ Access matches approved request
☐ Approval evidence retained

Evidence

8. Business Need

Determine whether access is still required.

For each account:

Why does this person need this access today?

☐ Current business need exists
☐ Business need documented
☐ Access supports current responsibilities
☐ Access is not retained merely because it was previously granted

9. Least Privilege

Verify:

☐ Users have only required access
☐ Read/write permissions are appropriate
☐ Administrative permissions are restricted
☐ Sensitive information access is limited
☐ Production access is justified
☐ Database permissions are appropriate
☐ Source-code access is appropriate
☐ Cloud permissions are appropriate
☐ Excess permissions identified

Excess Access

User	System	Current Access	Required Access	Action

10. Role-Based Access

Where role-based access is implemented:

☐ Roles are defined
☐ Role permissions are documented
☐ Users are assigned appropriate roles
☐ Role changes trigger access review
☐ Unused roles are reviewed
☐ Excessive permissions are identified
☐ Role ownership is defined

11. Joiner Access Review

For newly onboarded personnel:

☐ Identity verified
☐ Employment/contract confirmed
☐ Access request completed
☐ Business owner approval obtained
☐ Required systems identified
☐ Access granted according to role
☐ MFA enabled
☐ Security training completed where required
☐ Access evidence retained

12. Mover Access Review

When a user changes role:

☐ Previous role identified
☐ New role identified
☐ Previous access reviewed
☐ Unnecessary access removed
☐ New access approved
☐ New access matches responsibilities
☐ Privileged access reassessed
☐ Evidence retained

Key Test

Did the user receive new access without retaining unnecessary access from the previous role?

13. Leaver Access Review

For terminated or departed personnel:

☐ Termination date confirmed
☐ Corporate account disabled
☐ Cloud access removed
☐ SaaS access removed
☐ VPN access removed
☐ Production access removed
☐ Database access removed
☐ Source-code access removed
☐ Privileged access removed
☐ API credentials/tokens addressed
☐ Physical access removed where applicable
☐ Assets recovered
☐ Offboarding evidence retained

14. Dormant Accounts

Review accounts that have not been used for an extended period.

☐ Dormant accounts identified
☐ Business justification reviewed
☐ Unnecessary accounts disabled
☐ Service accounts distinguished from user accounts
☐ Exceptions documented
☐ Dormant account monitoring established

Account	Last Activity	Owner	Business Need	Action

15. Privileged Access

Identify all privileged users.

☐ Privileged accounts inventoried
☐ Business justification documented
☐ Appropriate approval obtained
☐ Named accounts used
☐ Shared administrator accounts avoided where practical
☐ MFA enabled
☐ Privileges limited
☐ Administrative access monitored where appropriate
☐ Privileged access periodically reviewed
☐ Unnecessary privilege removed

16. Administrator Accounts

For each administrator:

User	System	Privilege	Justification	MFA	Approved	Status

Verify:

☐ Administrator identity confirmed
☐ Role requires administrative access
☐ Access is approved
☐ MFA is enabled
☐ Privileges are appropriate
☐ Activity is logged where appropriate

17. Cloud Access

For cloud environments such as AWS:

☐ Cloud accounts identified
☐ IAM users reviewed
☐ IAM roles reviewed
☐ Root account access controlled
☐ MFA enabled
☐ Privileged roles identified
☐ Permissions reviewed
☐ Cross-account access reviewed
☐ Temporary access reviewed
☐ Service roles reviewed
☐ Unused permissions identified
☐ Public exposure considered where relevant

AWS Example

Review:

IAM users
IAM roles
Permission policies
AdministratorAccess
Root account
Cross-account roles
Access keys
MFA
CloudTrail activity

18. AWS Root Account

Where AWS is used:

☐ Root account identified
☐ Root credentials protected
☐ MFA enabled
☐ Root access keys disabled where possible
☐ Root account use restricted
☐ Root activity monitored/reviewed where applicable
☐ Emergency access process defined

19. Access Keys and Credentials

Review:

☐ Access keys inventoried
☐ Key owners identified
☐ Unused keys removed
☐ Key age reviewed
☐ Rotation requirements followed
☐ Secrets not exposed in source code
☐ Credentials stored securely
☐ Compromised credentials can be revoked

20. SaaS Application Access

For each critical SaaS application:

☐ Application owner identified
☐ User inventory available
☐ Admin accounts identified
☐ Access roles reviewed
☐ MFA enabled where required
☐ Former users removed
☐ External users reviewed
☐ Supplier access reviewed
☐ Dormant accounts reviewed
☐ Access review evidence retained

21. Production Access

Identify personnel with production access.

☐ Production users identified
☐ Business justification documented
☐ Approval obtained
☐ Access limited
☐ MFA enabled
☐ Privileged access controlled
☐ Production activity monitored where appropriate
☐ Temporary access used where practical
☐ Production access periodically reviewed

22. Database Access

☐ Database users identified
☐ Application accounts identified
☐ Administrative accounts identified
☐ Access justified
☐ Permissions reviewed
☐ Sensitive databases identified
☐ Direct production access restricted
☐ Shared accounts controlled
☐ Database credentials protected
☐ Former users removed

23. Source-Code Access

Review:

☐ Repository users
☐ Repository administrators
☐ Organization owners
☐ Branch permissions
☐ Deployment permissions
☐ External collaborators
☐ Contractor access
☐ Former employee access
☐ MFA
☐ Access reviews

24. CI/CD Access

☐ CI/CD users identified
☐ Pipeline administrators identified
☐ Deployment permissions reviewed
☐ Production deployment access restricted
☐ Service accounts reviewed
☐ Secrets protected
☐ Former users removed
☐ Emergency deployment access controlled

25. Remote Access

Review:

☐ VPN users
☐ Remote-access users
☐ MFA
☐ Privileged remote access
☐ Supplier remote access
☐ Dormant remote accounts
☐ Remote-access logs where appropriate
☐ Access aligned with current business requirements

26. Supplier and Third-Party Access

For each third party:

☐ Supplier identified
☐ Individual users identified
☐ Business justification documented
☐ Access approved
☐ Access scope limited
☐ MFA enabled
☐ Expiry date defined where appropriate
☐ Access periodically reviewed
☐ Contractual requirements considered
☐ Access removed at end of engagement

27. Temporary Access

Verify:

☐ Temporary access is explicitly identified
☐ Business justification documented
☐ Approval obtained
☐ Start date defined
☐ Expiry date defined
☐ Access automatically expires where practical
☐ Access reviewed after use
☐ Temporary credentials revoked

User	System	Purpose	Start	Expiry	Revoked

28. Emergency Access

Where emergency or break-glass access exists:

☐ Emergency accounts identified
☐ Business justification documented
☐ Access restricted
☐ Credentials protected
☐ MFA enabled where technically possible
☐ Use is logged
☐ Use is reviewed after the event
☐ Credentials rotated after use where required
☐ Emergency access periodically tested

29. Service Accounts

Identify non-human accounts.

☐ Service accounts inventoried
☐ Business owner assigned
☐ Technical owner assigned
☐ Purpose documented
☐ Permissions limited
☐ Credentials protected
☐ Credentials rotated where appropriate
☐ Interactive login restricted where appropriate
☐ Unused service accounts removed

Account	System	Purpose	Owner	Privilege	Status

30. API and Machine Access

☐ API accounts identified
☐ API keys/tokens inventoried
☐ Owners identified
☐ Permissions limited
☐ Expiry/rotation considered
☐ Secrets securely stored
☐ Unused tokens revoked
☐ Third-party integrations reviewed

31. Authentication Compliance

Verify:

☐ MFA implemented where required
☐ Strong authentication used
☐ Password requirements implemented where applicable
☐ Default credentials removed
☐ Authentication recovery controlled
☐ SSO configured where appropriate
☐ Authentication exceptions documented
☐ Authentication events monitored where appropriate

32. Segregation of Duties

Where applicable, review conflicting access.

Examples:

Developer + production approval
Requester + approver
Payment initiator + payment approver
User administrator + audit reviewer
Security administrator + independent reviewer

☐ Conflicting roles identified
☐ Conflicts assessed
☐ Compensating controls implemented where required
☐ Exceptions approved

33. Sensitive Information Access

Identify access to:

☐ Personal data
☐ Customer data
☐ Financial information
☐ Confidential information
☐ Restricted information
☐ Security information
☐ Source code
☐ Encryption keys
☐ Security logs

Verify:

☐ Access is justified
☐ Access is approved
☐ Access is restricted
☐ Access is periodically reviewed

34. Access Review Sampling

Select representative samples from:

☐ Employees
☐ Contractors
☐ Privileged users
☐ New users
☐ Recently transferred users
☐ Recently terminated users
☐ Suppliers
☐ Service accounts
☐ Production users
☐ Cloud administrators

Sample Results

Sample	Expected Access	Actual Access	Result	Action

35. Access Evidence

Review appropriate evidence such as:

☐ User lists
☐ IAM reports
☐ Access requests
☐ Approval records
☐ HR records
☐ Joiner/mover/leaver records
☐ Access-review reports
☐ MFA reports
☐ Privileged-access reports
☐ Cloud configuration
☐ Application user reports
☐ VPN reports
☐ Repository access reports
☐ Access logs where appropriate

Do not retain unnecessary:

Passwords
API keys
Private keys
Authentication secrets
Production credentials

36. Access Findings

Record identified gaps.

Finding ID	System	User/Account	Requirement	Condition	Risk	Action	Owner	Due Date

37. Access Risk Assessment

For significant access findings, consider:

☐ Confidentiality impact
☐ Integrity impact
☐ Availability impact
☐ Privacy impact
☐ Customer impact
☐ Regulatory impact
☐ Production impact
☐ Privilege level
☐ Data sensitivity
☐ Likelihood of misuse

Risk Level

☐ Low
☐ Medium
☐ High
☐ Critical

38. Immediate Access Remediation

Where inappropriate access is identified:

☐ Access disabled
☐ Excess privilege removed
☐ Credentials revoked
☐ Tokens revoked
☐ Sessions terminated where necessary
☐ Account owner notified
☐ Security incident considered
☐ Risk reassessed
☐ Evidence retained

39. Corrective Action

For recurring or systemic issues:

☐ Root cause identified
☐ Corrective action defined
☐ Owner assigned
☐ Target date established
☐ Remediation evidence collected
☐ Effectiveness verified
☐ Residual risk assessed
☐ Finding closed or escalated

40. Access Exceptions

Document approved exceptions.

Exception ID	Access	Reason	Risk	Compensating Control	Approver	Expiry

Verify:

☐ Business justification
☐ Risk assessment
☐ Appropriate approval
☐ Compensating control
☐ Expiry/review date

41. Access Review Metrics

Track useful metrics.

Metric	Result
Total users reviewed
Total systems reviewed
Privileged users reviewed
Supplier accounts reviewed
Dormant accounts identified
Excess access identified
Accounts removed
Access exceptions
Findings identified
High-risk findings
Findings closed
Overdue actions

42. Overall Access Compliance

Area	Compliant	Partial	Non-Compliant	N/A	Findings
User Access
Privileged Access
Cloud Access
SaaS Access
Production Access
Database Access
Source Code
Supplier Access
Service Accounts
Authentication
Remote Access
Temporary Access

43. Review Conclusion

Overall Result

☐ Access Appropriate
☐ Access Appropriate with Improvement Actions
☐ Significant Excess Access Identified
☐ Significant Unauthorized Access Identified
☐ Further Review Required

Summary

Significant Risks

Required Actions

44. Management / Access Owner Approval

Access/System Owner: ______________________

Security Reviewer: _________________________

Business Owner: ___________________________

Risk Owner: _______________________________

Management Approver: ______________________

Review Date: ______________________________

Approval Date: ____________________________

Next Review Date: _________________________

45. Review Frequency

Access review frequency should be based on risk.

High-Risk Access

Consider:

Monthly or quarterly review
Privileged access
Production access
Sensitive-data access
Security administration
Critical cloud environments

Medium-Risk Access

Consider:

Quarterly or semiannual review

Lower-Risk Access

Consider:

Annual review

Access should also be reviewed following:

☐ Role change
☐ Termination
☐ Security incident
☐ Major system change
☐ New privileged access
☐ Supplier change
☐ New production access
☐ Significant organizational change

46. AWS SaaS Startup Example

A SaaS startup operates its production environment on AWS and uses GitHub, a CI/CD platform, CRM, HR SaaS, and customer-support systems.

During a quarterly access review, the organization checks:

AWS

☐ IAM users
☐ IAM roles
☐ Administrator privileges
☐ Root account
☐ Access keys
☐ MFA
☐ Cross-account roles

GitHub

☐ Organization owners
☐ Repository administrators
☐ Developers
☐ External collaborators
☐ Former employees

Production

☐ Production administrators
☐ Database access
☐ Deployment access
☐ Temporary access

Example Finding

User: Former contractor

Access: GitHub repository + AWS role

Expected: Access removed after contract termination.

Actual: GitHub access removed, but AWS role remained active.

Risk: Unauthorized access to production resources.

Immediate Action: AWS role access revoked.

Root Cause: Contractor offboarding workflow covered corporate and GitHub access but did not include AWS.

Corrective Action: Add AWS and other cloud accounts to the mandatory offboarding checklist and automate access revocation where practical.

Verification: Perform a subsequent offboarding sample and confirm access is removed across all relevant systems.

47. Startup-Friendly Access Review Model

A startup can keep access reviews practical by prioritizing high-risk systems.

Monthly

Review:

AWS privileged access
Production access
Critical SaaS administrators
MFA
Dormant privileged accounts

Quarterly

Review:

Employee access
Contractor access
GitHub
CI/CD
Databases
Critical SaaS applications
Supplier access

Semiannual

Review:

Service accounts
API access
Remote access
Sensitive information access

Annual

Perform:

Complete access-control assessment
Role review
Segregation-of-duties review
Policy compliance review
Access-control risk assessment

48. Common Mistakes

Avoid:

Reviewing only user lists without checking actual permissions.
Assuming HR termination automatically removes all application access.
Ignoring cloud roles.
Ignoring service accounts.
Ignoring API tokens.
Ignoring third-party access.
Reviewing privileged access only once a year.
Allowing permanent temporary access.
Retaining excessive permissions after role changes.
Using shared administrator accounts unnecessarily.
Failing to review dormant accounts.
Closing access findings without verification.
Keeping sensitive credentials as audit evidence.

49. Relationship With Other ISMS Documents

Document	Relationship
Access Control Policy	Defines access requirements
Identity & Access Management Procedure	Defines access lifecycle
Privileged Access Procedure	Controls administrative access
Joiner/Mover/Leaver Procedure	Manages personnel access changes
Supplier Access Procedure	Controls third-party access
Cloud Access Review Checklist	Provides cloud-specific assessment
Information Security Compliance Checklist	Provides broader compliance assessment
Policy Compliance Review Checklist	Reviews compliance with access policies
Security Findings Register	Records access findings
Corrective Action Tracker	Tracks remediation
Information Security Incident Procedure	Handles suspected access compromise
Risk Register	Records significant access risks

50. ISO/IEC 27001 Connection

Access compliance reviews support the organization’s assessment of access-control arrangements, including:

Business requirements for access
User lifecycle management
Authentication
Privileged access
Access restrictions
Access review
Least privilege
Information protection
Cloud access
Supplier access

The Access Compliance Review Checklist is not itself a universally prescribed ISO/IEC 27001 form.

The organization should determine the scope, frequency, evidence, sampling approach, and review methodology based on its ISMS scope, risks, information sensitivity, technology environment, contractual obligations, and applicable controls.

51. Final Access Compliance Audit Trail

For every significant access review, the organization should be able to demonstrate:

Who has access?
What system or information can they access?
Why do they need it?
Who approved it?
Does the access match their current role?
Is the privilege appropriate?
Is MFA or appropriate authentication enabled?
Was the access periodically reviewed?
Were terminated or transferred users addressed?
Were excessive permissions identified?
Were inappropriate permissions removed?
Was remediation verified?
What residual risk remains?

Final Principle

Access compliance is not simply confirming that users exist in an access list. It is verifying that every significant access right remains justified, authorized, appropriately restricted, securely authenticated, periodically reviewed, and removed when no longer required.