Access Review Best Practices and FAQ

Do I need to perform access reviews for all vendor risk levels?

When conducting access reviews for vendors, you only need to perform reviews for high and critical risk vendors (Applicable to SOC 2, ISO27001, GDPR, HIPAA, PIPEDA).

Lower risk vendors do not require access reviews, allowing you to focus your efforts on the vendors that pose the greatest potential risk to your organization.

How often should my organization perform an access review?

As often as your Access Management (or similar) policy states! However, these are industry best standards:

An annual Access Review is sufficient for organizations up to 25 employees.

Organizations with 25-50 employees should conduct Access Reviews bi-annually.

Quarterly Access Reviews are required for 50+ employees, or if there is high turnover.