Access reviews: who still has the keys
We review, on a schedule, who can get into your directories, cloud accounts and key applications, and whether they still should. You get the clean-up and the evidence an auditor asks for.
Overview
Why access drifts
People join, change roles and leave. Contractors finish their projects. Service accounts outlive the systems that needed them. Each change is small, and nobody removes access with the same urgency as they grant it. After a year, the list of who can reach what rarely matches anyone's intent.
Black Fox runs periodic access reviews across the systems that matter: your directory, your cloud platforms and the applications that hold your data or your money. We collect the accounts and permissions, compare them with your records of who works where, and put each questionable entry in front of the person who can decide.
Privileged access gets more attention than the rest. Administrator, root and owner rights are where a single forgotten account does the most damage, and where auditors look first.
Who it is for
Organisations preparing for or maintaining ISO/IEC 27001, SOC 2, PCI DSS or similar, where periodic access review is an expected control, and any team that has grown, reorganised or changed systems and is no longer sure who can reach what.
The work, from scoping to evidence.
What we do
Systems in scope
We agree which systems are reviewed, for example your identity directory, cloud accounts, source code platform, finance and HR applications, and how often.
Account and permission extracts
We collect who has access and with which rights, from exports or read access you provide, and match accounts to real people.
Joiners, movers and leavers
We compare access against your HR and contractor records: leavers who still have accounts, movers who kept their old rights, joiners with more than their role needs.
Privileged access
Administrator and owner rights, shared and break-glass accounts, and service accounts reviewed one by one, with their owners named.
Owner attestation
Managers and system owners confirm or revoke each entry, and their decisions are recorded with dates.
Process review
We look at how access is requested, approved and removed, and recommend changes so the next review finds less.
How the engagement runs
Kickoff
We agree the systems, the review frequency, the owners and the evidence your auditors expect, and sign an NDA first if you need one.
Collection
We gather the account and permission data and your records of current staff and contractors.
Analysis
We match, compare and flag: orphaned accounts, excessive rights, segregation of duties conflicts and unexplained privileged access.
Attestation
Each owner receives their list, confirms or revokes, and we follow up on the answers that do not come.
Clean-up and evidence
Your teams remove what was revoked, we verify it, and the review is packaged as evidence. The cycle then repeats on the agreed schedule.
What you receive
- Inventory of accounts and permissions per system
- Findings report: orphaned accounts, excessive rights, conflicts
- Privileged access register with named owners
- Owner attestation records with decisions and dates
- Verification that revoked access was removed
- Process recommendations for joiners, movers and leavers
Questions
How often should access be reviewed?
It depends on the system and your framework. Privileged access and systems in scope for an audit are commonly reviewed more often than the rest. We help you set a frequency you can defend and actually keep.
Do you remove the accounts?
Your teams do, because they own the systems and the change process. We tell them what to remove, follow up and verify that it was done.
Will this satisfy our auditor?
We cannot speak for your auditor. We produce the evidence that access reviews are usually tested with: who was reviewed, by whom, what was decided and that the decision was carried out. Your auditor decides whether it meets the requirement.
Do you need administrator access to our systems?
No. Exports or read-only access are usually enough, and we agree how the data is handled and deleted before we receive it.
Related services
- Managed securityContinuous complianceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.
- Compliance and certificationSOC 2SOC 2 readiness from Black Fox Security: Trust Services Criteria scoping, gap assessment, control design and evidence preparation for your CPA firm's examination.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Governance and riskInformation security auditIndependent information security audits from Black Fox Security against ISO/IEC 27001, 27002, GDPR, PCI DSS, your own policies or a client's questionnaire.
Find out who still has the keys
Tell us which systems matter most and when your next audit is. We will propose a review that fits both.