The user access review template, column by column

The header that fixes the population

Six fields sit above the rows. They settle the question a reader asks before reading a single decision: which accounts were in front of the reviewer, and how anyone knows that was all of them.

The eleven columns

One row per account. The third column is the one your sheet will not have: the defect that makes a filled cell useless.

A worked row

A contractor whose production access outlived the engagement, as the row would sit in the sheet.

Where the account list comes from

A review of a list you typed proves you typed a list. The population has to come out of the system, at a stated moment, from a named report you can run again.

Keep the raw export beside the record and carry its row count across. If the export has 41 rows and the sheet has 38, the missing three are the review. The same rule runs through the evidence request list, which asks for whole populations.

The reviewer is not the person who granted the access

An administrator reviewing their own grants is making the same judgment twice. Nothing new gets tested. The control wants a second opinion from someone who knows what the job needs, not what the console allows.¹

At five people the pool is small and the reviewer may be a founder. Fine, and testable, as long as the record names both people and the names differ. What a small team actually has to do takes that substitution through the rest of the controls that assume more staff than you have.

What reviewed has to mean in writing

A decision, a reason, a name and a date, per row. Blank means not reviewed. Where a privileged account is kept, the reason column answers why an ex-migration contractor still held it.

A clean quarter is a legitimate outcome and gets written the same way. State the population and say that all 41 accounts were kept.

Silence is not a decision.

Terminated users, service accounts, shared credentials

Three row types break the pattern. The person the row is about is not the person holding the account.

Terminated users

They should not be in the active export at all, and this review is what catches them when they are. Check it against your leaver list. A leaver who appears gets a row carrying the termination date, the removal date and the gap in days.

Service accounts

Each needs a named human owner, the system it serves, and the dates its credential was last rotated and last used. No owner means nobody to ask. No recent use makes it a removal candidate, and saying so tells the next reviewer it was considered.

Shared credentials

List everyone holding it and say whether the system can attribute an action to one of them. If it cannot, put that in the reason column. A shared login with named holders and a written blind spot is a smaller finding than one nobody counted.

The evidence the review leaves behind

Five artifacts, dated in this order. Rebuilt from memory afterwards they carry the date of the rebuild, and the dates carry the test.

1. The source export, unedited, tool and timestamp visible.
2. The completed record, every row decided, reviewer named, dated.
3. One ticket per action, referenced by identifier from its row.
4. A system record per change: the log line showing access went.
5. A dated approval, signed after the last row was decided.

One habit protects all five. Do not re-save the record after the approval date. A sheet modified three months after the sign off invites a question the document cannot answer.

Which criteria this maps to

The logical access common criteria.¹ CC6.1 covers the access controls protecting the system. CC6.2 covers registering and authorizing users before credentials are issued, and removing access when it is no longer appropriate. CC6.3 covers authorizing, modifying and removing access by role, with least privilege and segregation of duties considered.

Your engagement fixes the exact mapping in its control matrix. Cadence is your choice, and your approved policy becomes the standard you are tested against.² The policy list covers how a promise inherited from a template turns into a deviation you never needed.