Question 1

What is an automated access review campaign?

Accepted Answer

An automated access review campaign is a scheduled governance workflow that queries identity providers, cloud consoles, and source code repositories to generate a centralized inventory of user permissions for manager or system owner recertification.

Question 2

Why do SOC 2 and ISO 27001 require periodic access reviews?

Accepted Answer

SOC 2 (CC6.1, CC6.2, CC6.3) and ISO 27001:2022 (Control A.5.18) mandate regular reviews of access rights to ensure that staff and contractor privileges remain strictly aligned with the principle of least privilege and that deprovisioning occurs immediately upon role change or termination.

Question 3

What are dormant or orphan accounts?

Accepted Answer

Orphan accounts are user accounts belonging to former employees or inactive contractors that were not properly deprovisioned. Dormant accounts are active identities that have not authenticated within a specified window (typically 60 to 90 days).

Question 4

How does automated access recertification work across multi-cloud environments?

Accepted Answer

Integration connectors poll APIs across identity providers (Okta, Google Workspace, Azure AD) and cloud infrastructure (AWS IAM, GCP IAM) to identify privilege drift and flag over-privileged roles for immediate administrative sign-off.

Automated Access Reviews & Identity Audit

Access Reviews & Identity Audit FAQs

Not sure what you need?