Review privileged access
Confirm each administrative, emergency, supplier, and shared capability has a current named purpose, accountable owner, appropriate authentication, and removal or remediation action.
| Field | Value |
|---|---|
| Business area | security-continuity |
| Primary role | it-security-administrator |
| Frequency | quarterly |
| Privacy sensitivity | high |
| Security sensitivity | high |
| Compliance review | needed |
Trigger and handoff
Trigger: Scheduled access review, role change, incident, or material system change.
Inputs
- Administrative account and role inventory
- Current owner attestations
- Authentication and usage evidence
Outputs
- Reapproved or removed privilege
- Unresolved ownership and control findings
- Review sign-off
Current manual methods
- Admin portal screenshots
- Manager memory
- Annual account list
Human judgment and approvals
-
Assess genuine operational and emergency need
-
Evaluate compensating controls and continuity risk
-
Approval: Independent system or business owner approves retained privilege; security owner verifies remediation
Failure modes
- Owner approves their own unnecessary privilege
- Hidden API keys and supplier access are omitted
Success metrics
- Privileged capabilities have current named owners and need
- Orphaned and excessive access closes by target