SFS 3 / SF 1

Back to SFS 3

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Are user access permissions to critical systems periodically reviewed throughout the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence of completed access review cycles confirming permissions remain appropriate

Assessment criterion and evidence

Actor: Organization's access management system. Scope: Critical systems and user accounts. Evidence period: Review period. Required evidence: Records of access review cycles. Negative criterion: No documented evidence of access reviews or presence of stale permissions without justification. Missing evidence: Pending until documented review evidence is provided

View the JSON record (opens in a new tab).

Assessment result: unset.