Access Reviews for SOC 2 and ISO 27001: The Complete Guide to User Access Certification

Why Access Reviews Are the Control Auditors Check First

Access control is the foundation of every compliance framework. It's the first area auditors examine because it touches everything else: if you can't demonstrate that only authorized users have access to sensitive systems and data, the rest of your security program is built on unstable ground.

Access reviews (also called user access certifications or entitlement reviews) verify that every user's access rights are appropriate for their current role. They answer three critical questions: Does this person still need this access? Is the access level appropriate for their job function? Are there any accounts that should have been deprovisioned?

The risk is real. Orphaned accounts (belonging to former employees), excessive privileges (accumulated through role changes without deprovisioning), and shared credentials represent the most common attack vectors. Access reviews are your systematic process for catching and remediating these issues before an attacker or auditor finds them first.

Access Control Requirements by Framework

Every major compliance framework mandates access reviews, but the specific requirements differ in scope and emphasis. Understanding these differences is crucial for building a unified access review program that satisfies all your frameworks simultaneously.

The good news: despite the different control numbers and terminology, the underlying requirements converge. A well-designed access review program that covers provisioning, periodic certification, privileged access, MFA, and deprovisioning will satisfy 90%+ of access control requirements across all five frameworks. LowerPlane's multi-framework mapping ensures a single access review campaign generates evidence for every applicable control.

Running Quarterly Access Certification Campaigns

An access certification campaign is a structured review where managers and system owners verify that each user's access is still appropriate. Here's how to run one efficiently:

The entire campaign, from data collection to completed remediation, should take 7-10 business days. Without automation, organizations report spending 4-6 weeks on the same process using spreadsheets and email chains, with significantly lower completion rates and audit trail quality.

Critical Systems: Where to Focus Your Access Reviews

Not every system needs the same level of access review scrutiny. Prioritize your efforts based on data sensitivity and regulatory impact. Here's a practical prioritization framework:

For PCI-DSS compliance, any system in the Cardholder Data Environment (CDE) or connected to it must be reviewed at minimum semi-annually per Requirement 7.2.5. HIPAA-regulated organizations should review all systems with access to ePHI at least quarterly. LowerPlane automatically classifies systems by tier based on the data they handle and the frameworks you're pursuing.

Detecting and Remediating Excessive Access

Excessive access is the most common finding in access reviews. It happens gradually: an engineer gets admin access to debug a production issue and never loses it. A marketing manager moves to a new team but keeps access to the old team's resources. A contractor's access outlives their engagement by months.

LowerPlane's access review engine automatically detects these patterns:

• 1.Dormant accounts: Users who haven't logged in for 30+ days. These represent the highest risk because compromised dormant credentials may go unnoticed indefinitely.
• 2.Privilege creep: Users whose permissions exceed their role's standard access profile. The platform compares each user's actual permissions against role-based baselines.
• 3.Separation of duties violations: Users with conflicting permissions (e.g., ability to both approve and execute financial transactions, or both deploy code and approve deployments).
• 4.MFA non-compliance: Users accessing critical systems without MFA enabled. This is flagged as a high-severity finding across all frameworks.
• 5.Orphaned accounts: Accounts belonging to users no longer in the HR system or identity provider, indicating incomplete offboarding.

Each detected anomaly is presented with context (when access was granted, who approved it, last login date) and recommended remediation actions. Reviewers can approve, modify, or revoke access with a single click, and the decision is documented as audit evidence automatically.

MFA Enforcement: The Non-Negotiable Baseline

Multi-factor authentication has moved from "recommended best practice" to "absolute minimum requirement" across every compliance framework. If your access review reveals users accessing critical systems without MFA, treat it as a critical finding requiring immediate remediation.

PCI-DSS 4.0 (effective March 2025) is explicit: Requirement 8.4.2 mandates MFA for all access to the cardholder data environment, and 8.4.3 requires MFA for all remote network access. There are no exceptions or compensating controls accepted.

For practical implementation, here's what auditors expect to see:

• •100% MFA coverage on identity providers (Okta, Azure AD, Google Workspace)
• •MFA on cloud consoles (AWS root and IAM users, Azure portal, GCP console)
• •MFA on source code platforms (GitHub, GitLab, Bitbucket) especially for production branches
• •MFA on VPN and remote access tools, with no exceptions for "convenience"
• •Hardware security keys (FIDO2/WebAuthn) recommended for privileged accounts over SMS or TOTP

LowerPlane's access review dashboard shows MFA enrollment status across all integrated systems in real time. During certification campaigns, users without MFA are automatically flagged as non-compliant, and the platform can trigger enrollment reminder workflows through Slack or email.

Frequently Asked Questions