Where could I find a template or example version of a written standard for periodic access reviews? Something that...
would help with ensuring all the right areas/topics are included in the standard. This would be used as a sort of guidance for data/IT security analysts, internal auditors, application owners, data custodians and delegated administrators, ensuring all were working from the same set of directions and expectations.
I'm happy to share the high-level overview of my periodic user access review standard:
- Identify the business owners of every application.
- Instruct business owners to classify the data in their applications. Corporate policy should define the different classifications.
- If there is no policy on periodicity of access reviews based on the data classification, create one. I would suggest access to high-risk applications should be reviewed quarterly and every application should have a review conducted at least on an annual basis.
- The business owner should identify the departments that use its application(s) and approve or reject them. I recommend this approach because the business owner may not know what individuals should have access to the application, but they should know what departments are and what level of access is appropriate for those departments. At the end of this step there should be two lists: Approved departments and rejected departments.
- Notify the managers of the rejected departments that all of the people in their department will have their access removed from the application(s). I would give the managers two weeks to negotiate with the business owner before removal.
- Send the managers of the approved departments a list of all their employees with access to the applications and give them two weeks to approve each individual. There should be two new lists at the end of this step: the approved individuals and the rejected individuals.
- Remove access of the rejected individuals.
- Make sure that all of the approval transactions are recorded in an auditable manner.
Also, a separate but important best practice is to make sure separation of duties among developers, data custodians and IT administration is well defined and documented.
There are some great products on the market that can help with this process. They are auditable, provide workflow engines, and some even interface with automated provisioning solutions. SailPoint Technologies Inc.'s Identity IQ and CA Inc.'s Eurekify's Sage are products worth investigating.
- Learn best practices for implementing and maintaining enterprise user roles.
- Privileged account management implementation made simple: Check out these steps.
Related Q&A from David Griffeth, featured expert
Are users at your enterprise creating weak passwords that could potentially lead to serious data breaches? In this identity and access management ...continue reading
Virtualization is a technology that's taking off, but how can information security professionals know how it will interact with their existing ...continue reading
When an enterprise gets new IAM systems, training employees on how to interact with the technology is one of the most important aspects of deployment...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.