Access Review - Privileged Users

• Site conducted

  Select

• Conducted on

  Date

• Prepared by

List Privileged Accounts

• Compile a list of all privileged accounts, both human and non-human (e.g., service accounts).

  Completed

  Not Completed

  Completed, But Issues Found

• What was the issues?

• Upload List of Privileged Accounts in ControlMap

  Yes

  No

  N/A

• Upload List of Privileged Accounts in ControlMap

  Yes

  No

  N/A

Current Permission Sets

• Identify the scope and depth of each privileged user's access rights.

  Completed

  Not Completed

  Completed, But Issues Found

• What was the issues?

Credential Management

• Review how credentials for these accounts are stored, managed, and rotated.

  Completed

  Not Completed

  Completed, But Issues Found

• What was the issues?

  Yes

  No

  N/A

Need for Privilege

• Confirm if the current level of privilege is necessary for the assigned roles.

  Yes

  No

  N/A

• Why not?

• Yes

  No

  N/A

Inactive Accounts

• Identify any privileged accounts that are dormant but still have high-level access.

  Yes

  No

  N/A

• What inactive accounts still had access?

• Yes

  No

  N/A

Separation of Duties

• Confirm that duties and access are appropriately separated to prevent conflicts of interest or fraud.

  Completed

  Not Completed

  Completed, But Issues Found

• What were the issues and what was done about it?

• Yes

  No

  N/A

Technical Validation

• Have IT security validate the appropriateness of the access levels.

  Yes

  No

  N/A

• Were any issues found?

  Yes

  No

  N/A

• What was found?

Business Validation

• Get sign-off from senior managers or business owners for the current level of privileged access.

  Yes

  No

  N/A

De-Provision

• Remove unnecessary privileged accounts or downgrade to lower access levels.

  Completed

  Not Needed

• Why?

• What account was De-Provision?

Adjust Permissions

• Correct over-permissions or under-permissions based on the review findings.

  Completed

  Not Needed

• What permissions were adjusted?

• Why

User Training

• Re-train users who will continue to have privileged access about the responsibilities and risks involved.

  Completed

  Not Needed

• Why not needed?

  Yes

  No

  N/A

• What users were Re-train?

Credential Updates

• Update or rotate credentials for remaining privileged accounts.

  Yes

  No

  N/A

• Why were not credentials updated?

• What credentials were updated?

• Yes

  No

  N/A