Privileged Access Review Checklist

When to use this

Use this checklist during periodic reviews of privileged users, privileged roles, emergency access, and stale access.

Related controls

• A.8.2 Privileged Access Rights
• Privileged Access Register

Review checklist

• Privileged users still need access.
• Privilege scope is limited to business need.
• Separate privileged identities are used where feasible.
• Shared admin accounts are identified and risk-treated.
• Emergency access is reviewed.
• Privileges for leavers/movers are removed.
• Excess privilege is revoked or reduced.

Review record