Review what the account can still do
An access review needs more than a list of active employees. Supplier accounts, service identities, inherited permissions, and active sessions can preserve access after the original reason has ended.
Ask the resource owner to confirm the business need for each material privilege. Check dependencies before removal, then verify the result through the supported administrative path. Include an expiry for temporary exceptions and a way to restore essential access safely.
Put it into practice
Start with leavers, dormant administrators, vendor remote-access accounts, and shared credentials. Ask the service owner to confirm need. Disable safely before deletion where dependencies are uncertain, and verify that active sessions and tokens are revoked.
Implementation steps
- Inventory effective accessList people, workload identities, federation paths, local administrators, active tokens, and emergency accounts for a bounded service. Include inherited permissions and alternative access paths.
- Make a business decisionAsk the resource owner to keep, narrow, remove, or temporarily except each material privilege. A justified keep decision is valid; review quality is not measured by removals alone.
- Enforce and retestApply changes through the supported administrative path. Test necessary work and a denied action, then verify session or token revocation where relevant. Preserve emergency access without allowing an undocumented bypass.
- Operate the lifecycleConnect joiners, role changes, departures, workload retirement, and credential expiry to accountable owners. Recheck after service changes and use exception expiries to prevent temporary access becoming permanent.
Track owner coverage and privilege review completion
| Measure | Calculation or definition | How to use it |
|---|---|---|
| Owner coverage | In-scope identities with a confirmed owner / in-scope identities | Investigate orphaned workload and supplier identities. |
| Privilege review completion | Permissions with recorded decisions / permissions in review scope | Include keep decisions and unresolved dependencies. |
| Revocation verification | Revocations with a successful denied-access test / revocations sampled | Do not equate an admin-console change with an effective session boundary. |
Identity ownership and verification
Worked example. Figures are illustrative.
| Observation | Identities |
|---|---|
| Inventoried | 100 |
| Owner confirmed | 80 |
| Access tested | 65 |
Measure the same identity population over a defined review period.
The record to keep
The deliverable: An access-review disposition list with keep, narrow, disable, exception, and recheck decisions.
Start with the service holding the most sensitive or consequential access. Close the loop on removal decisions by checking that the denied action really is denied.
References
- NIST SP 800-207: Zero Trust Architecture — Treat access to resources as an explicit policy decision rather than trust inherited from network location.
- NIST Cybersecurity Framework — Use outcomes and organizational context to organize the risk discussion; a framework mapping is not a control test.
Keep reading.
October 30 market close: Intel plunges, Nasdaq falls 2.86%
Intel falls 28.58% as its outlook weighs on technology. Nasdaq loses 2.86%, energy leads sector gains, and labor-cost data and weekly returns frame the Friday close.
4 min read →
October 29 market close: Alphabet sinks, small caps advance
Alphabet falls 12.64% and the Nasdaq loses 1.38%, while small caps and nine sector ETFs gain. GDP, inflation and Amazon earnings frame a sharply divided session.
4 min read →
October 28 market close: Fed holds, Alphabet drops after hours
The Fed holds rates at 3.75%–4.00% in a split vote. Cash indexes edge higher, while Alphabet’s late after-hours decline sets a different test ahead of Thursday’s GDP and inflation data.
4 min read →