LS-10: External User Access Review

Control Description

On a semi-annual basis, the Company provides an external user access listing to each client for review.

Plain Meaning

This control requires organizations to provide clients with a list of external users who have access to their data or systems every six months. This allows clients to review and verify that only authorized external users have access to their information.

Implementation

Access Review Process

Review Requirements

• Generate external user access listings every 6 months
• Provide complete access information to each client
• Allow clients to review and approve access
• Document client feedback and any requested changes
• Implement access changes based on client feedback

Access Information to Include

• External user names and contact information
• Systems and applications accessed
• Access levels and permissions granted
• Date access was granted
• Business justification for access
• Access status (active/inactive)

Implementation Approach

Access Listing Generation

• Automated Reports: Use identity management systems to generate reports
• Manual Compilation: , manually compile access lists
• Client-Specific Reports: Customize reports for each client's data
• Access Verification: Verify accuracy of access information before sending

Simple Implementation Steps

1. Inventory External Users: Document all external users with access
2. Generate Access Reports: Create detailed access listings
3. Review for Accuracy: Verify all information is current and correct
4. Distribute to Clients: Send reports to appropriate client contacts
5. Collect Feedback: Gather client responses and requested changes
6. Implement Changes: Update access based on client feedback

Client Communication

• Establish clear communication channels with clients
• Provide access reports in agreed-upon format
• Set reasonable response timeframes for client review
• Document all client communications and decisions
• Follow up on any outstanding access issues

Key Success Factors

1. Regular Schedule: Consistent semi-annual review process
2. Complete Information: Comprehensive access listings provided
3. Client Engagement: Active client participation in review process
4. Timely Response: Prompt implementation of client feedback
5. Documentation: Complete records of all review activities

Common Pitfalls to Avoid

• Irregular Reviews: Not conducting reviews on schedule
• Incomplete Information: Missing or inaccurate access data
• No Client Feedback: Not collecting or acting on client input
• Poor Communication: Unclear or delayed communication with clients

Related Controls

• LS-04: External user account management
• LS-24: Quarterly access reviews
• LS-22: Manager approval for access requests