# Access Review Record
**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
| System | Review ID | Review type | Period covered | Status |
| --- | --- | --- | --- | --- |
| [Fill in: system name and identifier] | [Fill in: unique review ID] | [Fill in: privileged accounts, all accounts, or both] | [Fill in: dates] | [Fill in: in progress, actions open, or complete] |
## 1. Scope and frequency
- The [System owner] reviews all accounts on the system [Fill in: the frequency of account review. Typical: quarterly for privileged accounts and at least annually for all other accounts] for compliance with the Access Control Policy and the account management procedure (AC-2j).
- The [System owner] reviews the privileges assigned to [Fill in: roles or classes of users to which privileges are assigned. Typical: all roles and classes of users on the system], [Fill in: the frequency at which to review the privileges assigned to roles or classes of users. Typical: quarterly for privileged roles and at least annually for all other roles], to validate the need for them (AC-6(7)(a)).
- The [Account manager] disables or removes the accounts, and reassigns or removes the privileges, that the review finds are not needed (AC-2j, AC-6(7)(b)).
## 2. Account list
| Field | Entry |
| --- | --- |
| Sources of the account list | [Fill in: for example the identity provider, the application's own user table, the database, the cloud console] |
| Date and time each list was extracted, and by whom | [Fill in: dates and names] |
| Number of accounts reviewed | [Fill in: count, by type] |
| How completeness was checked | [Fill in: for example account counts compared between the sources; service and emergency accounts listed in the account management procedure all present] |
## 3. Account decisions
Every account on the list gets a row. Supervisors confirm the need for their users' access; the [System owner] decides.
| Account ID | User or owner | Account type | Roles and groups | Privileged? | Last logon | Need confirmed by | Decision | Reason | Action ticket | Action completed |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: account ID] | [Fill in: name, or owner of a service account] | [Fill in: type] | [Fill in: roles] | [Fill in: yes or no] | [Fill in: date] | [Fill in: supervisor name and date] | [Fill in: keep, change, disable or remove] | [Fill in: reason, for example left the organization, changed role, inactive] | [Fill in: ticket] | [Fill in: date] |
Flag in the reason column any account with no logon for [Fill in: time period for account inactivity before disabling. Typical: 90 days] that the system did not disable automatically, and record why (AC-2(3)(d)).
## 4. Checks
| Check | Result |
| --- | --- |
| Accounts of people who have left or transferred, compared with the [Human resources office]'s list of departures and transfers for the period | [Fill in: number found still enabled, and actions] |
| Accounts with no named user or owner | [Fill in: number found, and actions] |
| Shared and group accounts: approved exception, current member list, authenticator changed after each departure (AC-2k) | [Fill in: result] |
| Emergency accounts: disabled when not in use, every use reviewed | [Fill in: result] |
| Roles held together that the account management procedure says must be separated (AC-5) | [Fill in: conflicts found, and how resolved] |
| Privileged users without a separate non-privileged account (AC-6(2)) | [Fill in: number found, and actions] |
| Accounts whose roles do not match an approved access request | [Fill in: number found, and actions] |
## 5. Sign-off
| Role | Name | Date |
| --- | --- | --- |
| Reviewer: [System owner] | [Fill in: name] | [Fill in: date the decisions were made] |
| [Account manager], confirming every action in section 3 is complete | [Fill in: name] | [Fill in: date] |
| Summary | Entry |
| --- | --- |
| Accounts kept | [Fill in: count] |
| Accounts changed | [Fill in: count] |
| Accounts disabled or removed | [Fill in: count] |
| Findings for the plan of action and milestones | [Fill in: weaknesses found, for example terminated users still enabled, or none] |
| Next review due | [Fill in: date] |
## Register
| Review ID | System | Type | Period covered | Reviewer | Accounts reviewed | Changed | Disabled or removed | Conflicts found | Actions completed | Signed off | Next due |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: system] | [Fill in: privileged, all, or both] | [Fill in: dates] | [Fill in: name] | [Fill in: count] | [Fill in: count] | [Fill in: count] | [Fill in: count] | [Fill in: date] | [Fill in: date] | [Fill in: date] |