Initial commit

03-procedures/access-review-procedure.md

@@ -0,0 +1,84 @@
+Title: Access Review Procedure
+Document ID: [PROC-ACCESS-REVIEW-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CISO (Paul Jenkins)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Access Review Procedure
+
+## Purpose
+
+This procedure defines how BlackDice should review user, privileged, and service access to ensure it remains appropriate.
+
+## Scope
+
+This procedure applies to in-scope systems, services, cloud platforms, repositories, administrative functions, and other controlled access points.
+
+## Trigger / When Used
+
+Use this procedure:
+
+- at planned review intervals
+- after significant role or organisational changes
+- after incidents, audit findings, or suspected misuse
+- when required for high-risk or privileged environments
+
+## Procedure Steps
+
+1. Define the scope of the review, including the systems, accounts, and review period.
+2. Extract or compile the current access listing from the relevant systems or authoritative source.
+3. Identify account types requiring review, including user accounts, privileged accounts, service accounts, temporary accounts, and shared accounts where they exist.
+4. Send the review to the appropriate manager, asset owner, or system owner for validation.
+5. Confirm whether each access right remains required, appropriate, and proportionate to the current role or system purpose.
+6. Record required changes, including removals, privilege reductions, account disablement, or further investigation.
+7. Complete the approved changes and confirm closure of review actions.
+8. Retain review evidence and track overdue or incomplete reviews to resolution.
+
+## Inputs
+
+- current access listing
+- system ownership information
+- personnel role information
+- previous review results where relevant
+
+## Outputs / Records
+
+- completed access review record
+- required remediation actions
+- evidence of changed or removed access
+- escalation record for unresolved items
+
+## Roles and Responsibilities
+
+- [Role] must coordinate the access review process.
+- Managers and system owners must validate access under their responsibility.
+- Administrators must implement approved changes.
+- Internal reviewers may sample evidence for assurance purposes.
+
+## Escalation / Exceptions
+
+Escalate when:
+
+- reviewers do not complete reviews within the required timeframe
+- privileged access cannot be validated
+- unexplained accounts or excessive permissions are identified
+- technical limitations prevent evidence collection
+
+Exceptions must be documented and approved through the defined process.
+
+## Related Documents
+
+- Access Control Policy
+- Identity and Authentication Standard
+- Joiner Mover Leaver Procedure
+- Corrective Action Procedure
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |