How often should access be reviewed?

Quarterly for production and sensitive systems is common; less critical systems are often reviewed twice a year. Review immediately after a reorganisation or a security incident.

Who should review access?

The owner of each system, or each person’s manager - never the account holder themselves.

Why is a leading = sign prefixed in the spreadsheet?

Cells that start with `=`, `+`, `-`, or `@` are run as formulas by spreadsheet apps. The export neutralises them, so pasted data cannot execute.

Free tool · no account

User access review template

A periodic access review confirms that everyone with access still needs it. Choose the systems in scope and who reviews each, and download a spreadsheet to fill in and a written procedure to keep with the evidence.

Team or company

Review period

Systems in scope, and who reviews each

Blank rows per system

Procedure

# Access review: Our team, this period

## Scope

- AWS
- GitHub
- Production database
- Production servers (SSH)

## Procedure

1. Export the current list of accounts and their roles from each system, and save the export with the date it was taken.
2. Paste each account into the spreadsheet with the person it belongs to. Flag shared, service, and unknown accounts.
3. Compare against the current staff and contractor list. Anyone who has left is removed today, not at the end of the review.
4. For each remaining account, the reviewer confirms the role is still needed for the person’s current job, and marks Keep, Reduce, or Remove.
5. Make every change, and link the ticket or change record in the spreadsheet.
6. The reviewer signs off with the date. Keep the exports, the completed spreadsheet, and the tickets together as evidence.

## Notes

- A reviewer must not approve their own access.
- Accounts with no activity this period are candidates for removal.
- Admin and production access deserve a closer look than read-only access.

Periodic user access reviews are commonly requested as SOC 2 evidence for the logical access criteria (CC6.2 and CC6.3). What your auditor needs is their call; this gives you a consistent record to start from.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Evidence that keeps itself

Shortspan’s audit log records every credential release by person and project, refusals included - the record an access review is meant to confirm.

Create a free workspace See what Shortspan does

What a review involves

Export who has access to each system, match every account to a person, check the list against current staff, and have someone other than the account holder confirm each role is still needed. Remove or reduce what is not, and keep the exports, the decisions, and the tickets as evidence.

Why auditors ask for it

SOC 2’s logical access criteria (CC6.2 and CC6.3) cover granting, changing, and removing access, and a periodic user access review is the evidence commonly offered for them. Quarterly is a common cadence for production systems. Your auditor decides what is sufficient; this gives you a consistent record to start from.

Common questions

How often should access be reviewed?: Quarterly for production and sensitive systems is common; less critical systems are often reviewed twice a year. Review immediately after a reorganisation or a security incident.
Who should review access?: The owner of each system, or each person’s manager - never the account holder themselves.
Why is a leading = sign prefixed in the spreadsheet?: Cells that start with =, +, -, or @ are run as formulas by spreadsheet apps. The export neutralises them, so pasted data cannot execute.

More free tools