Access reviews

ISO 27001 asks you to review access rights at set times. Under Registers, choose Access reviews. The register shows when your organisation has ISO 27001 switched on.

Record each review with the system, the day, who did it, the scope (such as all accounts with admin rights), the outcome and how many accounts were removed. Set the date of the next review: the person who did the review gets a reminder two weeks before, and once more when it has passed. Once you record a newer review of the same system, the older one no longer sends reminders.

Evidence

Choose Evidence on a review's row to add one file, such as an export of the accounts. Adding another file replaces it. The file is stored encrypted with a key of your own organisation and is part of your data export.