Rules to control physical and logical access to information and other associated assets shall be established and implemented based on business and information security requirements.
Consider implementing automated access review process to reduce manual effort and improve accuracy.
Quarterly privilege recertification exists, but two legacy systems are still excluded from the review population.
Sample of quarterly privileged-access recertifications with confirmed approvals.
Started interview with CISO regarding access control implementation. Policy was last reviewed in Q4 2025 and is scheduled for an update in Q2 2026.
Access control matrix reviewed – covers all critical systems (ERP, CRM, AD). Legacy systems (2 remaining) not yet migrated.
Quarterly review cycle observed for privileged accounts. Last review completed March 2026.