Information Access Restriction Review Checklist

When to use this

Use this checklist to test whether application, database, reporting, export, and maintenance access restrictions match approved access rules.

Related controls

• A.8.3 Information Access Restriction
• Information Access Rule Matrix
• Access Review Checklist

Review checklist

• Confirm access rules are owner-approved.
• Compare role permissions with business need.
• Sample users in each role.
• Compare application permissions with database permissions.
• Check whether restricted menus and functions are hidden or blocked.
• Review report builder and bulk export permissions.
• Review print/download controls for sensitive information.
• Check maintenance utilities and rarely used functions.
• Review temporary access or dynamic privilege sessions.
• Record gaps and corrective actions.

Findings table