Skip to main content
All measures

Measure · ISO 27001 and other standards

Review and correct access rights

Compare configured access rights with current tasks. Decide how to address differences and follow necessary changes through to effective implementation.

Accountable: Business owners with administrationReviewed

Reuse existing records

Use existing access records, the authoritative role model and your current request or change cases. An additional decisions sheet is only needed where those details are missing. Accounts and access rights remain in the directory service or application.

What to do

  1. 1

    Use the current access records

    Choose an application and identify who makes business decisions about access. Use current records from the application or directory service. Record the source, date and reviewed scope. Include direct grants, groups and administrative access, as well as relevant external and technical identities.

  2. 2

    Compare permissions with the task

    Compare effective permissions with the current task, the authoritative role model and approved exceptions. Choose Keep, Change, Revoke or Clarify and record the reason in the existing case. When someone changes roles, also review their previous permissions and consider incompatible duties.

  3. 3

    Implement changes and check completion

    Have administration carry out approved changes. Check in the target system that the relevant permissions have actually changed. Link the result to the existing case. Assign an owner and deadline to outstanding questions. Plan the next review according to risk and also consider changes to tasks or employment.

Worked example

An expired support grant remains active

An external provider still has administrative CRM access after the project ends. Its time-limited approval has expired.

Administrative support permissions
DecisionThe responsible business role requests revocation. Administration considers group membership and additional direct grants, then checks the effective permissions afterwards.
EvidenceThe existing support case contains the decision, completed change and a reference to the checked access records.

Record the result

  • Source, date and scope of the actual access records with the business decisions.
  • Completed changes and verified results in the existing case. Open items have owners and deadlines.

Common implementation mistakes

Only reviewing the previous approval

Compare effective permissions with the current task. Direct grants and nested groups can differ from the approved model.

Treating a request as completed revocation

Sending an instruction does not change access. Verify the completed change before closing the correction.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.18 · ZugangsrechteGerman guide

    The workflow supports reviewing and correcting logical access rights. The other provisioning processes and physical access rights require the appropriate operational workflow.

  • TISAX · 4.2.1

    VDA ISA 6.0.3 · Partial overlap

    The review and correction support regular checks of effective access rights. The complete provisioning process, technical enforcement and further requirements for the relevant protection needs still require separate work.

    Reference

Templates for your implementation

Related resources

Sources and further reading