The access control matrix template: every system, role and approval
Every system, the roles that reach it, the access each holds and who approved it.
An access control matrix is one table: every in-scope system, the roles that can reach it, the level of access each role holds, and who approved that design. It is the reference an access review checks real accounts against.
The workbook is below with starter rows and a guidance sheet. Replace the roles with the ones your company actually uses.
The template in full
Below is the whole workbook as it downloads. Every bracketed field, such as [Company name], is a detail to fill in before you adopt it. There is no form and no email address to hand over, and the file is yours to edit.
Access Control Matrix
Access matrix
One row per system and role at [Company name]. Update it whenever access is granted, changed or removed, and confirm every row in the quarterly access review.
| System | Role or group | Access level | Who holds it | Approved by | Justification | Last reviewed |
|---|
The sheet starts empty: one row per entry, under these columns.
How to use
- Check the starter rows. Each in-scope system has an Administrators row and a standard-user row. Change the role name or access level where it does not match how the system is set up.
- Add any system that is missing, such as the product database, HR or payroll tools, password manager and support desk.
- In "Who holds it", list the people or groups in that role by name, taken from the system itself (the admin console or user list), not from memory.
- Keep Admin to as few people as possible. Two named administrators per system is a common target, so one can cover for the other.
- Every row needs an approver. [Security owner role] approves access unless the matrix names someone else, and nobody approves their own access.
- Write a justification tied to the job, for example "Deploys the product" rather than "Needs it".
- When someone joins, moves role or leaves, update the matrix on the same day the access changes.
- Every quarter, compare each row to the live user list in the system, fix any difference, and enter the date in "Last reviewed". Record the review itself in the Access Review Log.
- Evidence for the auditor: this workbook with current review dates, plus a screenshot or export of the user list for each system.
What an auditor checks
An auditor compares real accounts with this matrix. An engineer holding admin rights the matrix gives only to the security owner is a finding, and so is a system that appears in the inventory but not here.
They also check who approved the matrix and when. Pair it with the user access review, which records the periodic check of each account against these roles.
Which criteria it maps to
It supports CC6.1, CC6.2 and CC6.3.1 A template is evidence of intent. The examination tests whether the control operated over the period, so keep the dated records the workbook produces. Every criterion, explained one by one, is on the Trust Services Criteria page.
Questions
What is an access control matrix?
How is an access matrix different from an access review?
How often should the access control matrix change?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.