Do you review user access regularly?
A access question from almost every security questionnaire. Here is a model answer, the evidence a reviewer may ask for, and what to say if you don't do this yet.
A model answer
Yes. Access to systems holding customer data is reviewed [quarterly] by [role], and anything no longer needed is removed. Leavers lose access on their last day through [process or identity provider offboarding].
Replace the parts in square brackets with what's true for you, and only answer yes to what you do.
Evidence a reviewer may ask for
- The record of the most recent review: who reviewed, what was removed, and when
- Your offboarding checklist
If you don't do this yet
If reviews are informal, say so and describe what does happen: "Access is removed at offboarding through our identity provider; formal quarterly reviews start in [month]."
Related questions
Do you enforce multi-factor authentication?A model answer, the evidence behind it, and what to say if you don't do it yet.Is customer data encrypted in transit and at rest?A model answer, the evidence behind it, and what to say if you don't do it yet.Security questionnaires without SOC 2How to answer a customer's questionnaire honestly before you have an audit.
Answer it once, on your trust center, for every reviewer.
From £39 a month. No sales call.