Access Review Record

Access Review Record template: The record of one periodic review of a system's accounts and privileges, with a decision for every account, the actions taken and the sign-off, and a register of every review, as SP 800-53 AC-2j and AC-6(7) require.

Type	Program stage	Status	Template version	NIST basis
Form or register	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The record of one periodic review of a system’s accounts and privileges, with a decision for every account, the actions taken and the sign-off, and a register of every review, as SP 800-53 AC-2j and AC-6(7) require.

Controls satisfied

Control	Title
AC-2	Account Management
AC-2(3)	Disable Accounts
AC-5	Separation of Duties
AC-6(7)	Review of User Privileges

Downloads

Variant	Ready to adopt	Annotated
All baselines	Word · Markdown	Word · Markdown

The register as a spreadsheet: CSV, with one column per field.

Preview (annotated)

Guidance

Use one record for each review of a system. Section 5.8 of the account management procedure is the process; this record is its evidence. Assessors ask for the last review and look for four things: the account list was complete, including service, emergency and application-local accounts; every account has a decision; accounts the review flagged were actually disabled or removed, with dates; and the reviewer is someone who knows whether each person still needs the access. A review in which no account is ever removed is a common finding, and so is a list exported only from the identity provider when the application keeps its own accounts. An identity governance tool can run the review and keep these fields; export its report and attach it here. The register at the end is also downloadable as a CSV file.

System	Review ID	Review type	Period covered	Status
Fill in: system name and identifier	Fill in: unique review ID	Fill in: privileged accounts, all accounts, or both	Fill in: dates	Fill in: in progress, actions open, or complete

1. Scope and frequency

• The System owner reviews all accounts on the system Fill in: the frequency of account review Typical: quarterly for privileged accounts and at least annually for all other accounts for compliance with the Access Control Policy and the account management procedure (AC-2j).
• The System owner reviews the privileges assigned to Fill in: roles or classes of users to which privileges are assigned Typical: all roles and classes of users on the system, Fill in: the frequency at which to review the privileges assigned to roles or classes of users Typical: quarterly for privileged roles and at least annually for all other roles, to validate the need for them (AC-6(7)(a)).
• The Account manager disables or removes the accounts, and reassigns or removes the privileges, that the review finds are not needed (AC-2j, AC-6(7)(b)).

2. Account list

Field	Entry
Sources of the account list	Fill in: for example the identity provider, the application’s own user table, the database, the cloud console
Date and time each list was extracted, and by whom	Fill in: dates and names
Number of accounts reviewed	Fill in: count, by type
How completeness was checked	Fill in: for example account counts compared between the sources; service and emergency accounts listed in the account management procedure all present

3. Account decisions

Every account on the list gets a row. Supervisors confirm the need for their users’ access; the System owner decides.

Account ID	User or owner	Account type	Roles and groups	Privileged?	Last logon	Need confirmed by	Decision	Reason	Action ticket	Action completed
Fill in: account ID	Fill in: name, or owner of a service account	Fill in: type	Fill in: roles	Fill in: yes or no	Fill in: date	Fill in: supervisor name and date	Fill in: keep, change, disable or remove	Fill in: reason, for example left the organization, changed role, inactive	Fill in: ticket	Fill in: date

Flag in the reason column any account with no logon for Fill in: time period for account inactivity before disabling Typical: 90 days that the system did not disable automatically, and record why (AC-2(3)(d)).

4. Checks

Check	Result
Accounts of people who have left or transferred, compared with the Human resources office’s list of departures and transfers for the period	Fill in: number found still enabled, and actions
Accounts with no named user or owner	Fill in: number found, and actions
Shared and group accounts: approved exception, current member list, authenticator changed after each departure (AC-2k)	Fill in: result
Emergency accounts: disabled when not in use, every use reviewed	Fill in: result
Roles held together that the account management procedure says must be separated (AC-5)	Fill in: conflicts found, and how resolved
Privileged users without a separate non-privileged account (AC-6(2))	Fill in: number found, and actions
Accounts whose roles do not match an approved access request	Fill in: number found, and actions

5. Sign-off

Role	Name	Date
Reviewer: System owner	Fill in: name	Fill in: date the decisions were made
Account manager, confirming every action in section 3 is complete	Fill in: name	Fill in: date

Summary	Entry
Accounts kept	Fill in: count
Accounts changed	Fill in: count
Accounts disabled or removed	Fill in: count
Findings for the plan of action and milestones	Fill in: weaknesses found, for example terminated users still enabled, or none
Next review due	Fill in: date

Register

Review ID	System	Type	Period covered	Reviewer	Accounts reviewed	Changed	Disabled or removed	Conflicts found	Actions completed	Signed off	Next due
Fill in: ID	Fill in: system	Fill in: privileged, all, or both	Fill in: dates	Fill in: name	Fill in: count	Fill in: count	Fill in: count	Fill in: count	Fill in: date	Fill in: date	Fill in: date