Cybersecurity · Access control
Which systems to check, who reviews and signs off, the warning signs to look for and how to keep a record that satisfies insurers and auditors.
Review every quarter, admins more often
Managers review, an owner signs
Record every decision with dates
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
A user access review is a scheduled check that every account in your business still belongs to a current person who needs exactly the access it has. For a small business, a good process runs every quarter and takes four steps: export the list of users and permissions from each key system, have each manager confirm or reject their team’s access, remove or reduce what is not needed, and record who approved what and when. IT prepares the lists and makes the changes, managers review, and an owner or senior manager signs off. Admin accounts deserve a closer look, and many businesses review them monthly.
Done this way, a quarterly review takes a few hours and catches the accounts that attackers love: leavers, dormant logins, forgotten vendors and people with far more access than their job needs.
Access drifts. People change roles and keep old permissions. Contractors finish and their accounts stay on. A shared login gets passed around. The CIS Critical Security Controls call for keeping an inventory of all accounts, disabling dormant accounts after 45 days of inactivity where supported, and revoking access immediately when someone leaves or changes roles. NIST’s account management control, AC-2 in SP 800-53, also expects organizations to review accounts on a defined schedule.
Cyber insurers ask about it too. Access reviews and prompt removal of former employees appear on many applications, and auditors for larger clients often request evidence.
Start with the systems where a misused account would hurt the most:
Keep a simple register listing each system, its owner and where the user list comes from. That register becomes your review checklist.
Pulls user and permission lists, flags obvious problems, makes approved changes and keeps the records.
Confirm each person on their team still needs each access level. They know the jobs; IT does not.
Reviews admin and finance access, approves exceptions and signs off that the review is complete.
One rule matters: nobody approves their own access. The owner’s admin rights should be reviewed by someone else, such as a partner or your IT provider, and noted as such.
Not sure who can get into what at your business? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and applications, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Expect the first pass to uncover years of build-up, so plan a full day rather than an afternoon. As an illustrative example, a first review in a 30-person office might turn up a handful of accounts for people who left long ago, a former bookkeeper still on the bank portal, several staff with admin rights they were given to install one program, and a generic front desk or scanner account with a password everyone knows.
Work through it in order of risk:
After that, quarterly reviews become short, because there is far less to find. Track how many changes each review produces. A falling number means the day-to-day process is working.
Microsoft Entra has a built-in access reviews feature that emails reviewers and can remove access automatically when a review is not approved. As of 2026, Microsoft says it requires Microsoft Entra ID Governance or Entra Suite licenses, with some capabilities available under Entra ID P2. For most businesses under 100 people, exports and a well-structured spreadsheet are enough. What matters is that the review happens on schedule and leaves a record.
Quarterly reviews catch what slipped through. Day-to-day habits keep the list clean in the first place:
Access reviews and same-day removal of leavers are part of JLB USA’s cybersecurity services. For the departure side, use our employee offboarding IT checklist.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Quarterly suits most small businesses, with admin and finance access often reviewed monthly. Also review after events like reorganizations, mergers or a security incident.
Managers confirm their team’s access, and an owner or senior manager signs off on the overall review and on admin and finance access. Nobody should approve their own access.
Former staff and contractors, accounts with no sign-in for 45 days or more, people with access from an old role, excess admin rights, shared logins, stale guest and vendor accounts, missing MFA and unusual mailbox forwarding.
Not under about 100 people. Exports from Microsoft 365 or Google Workspace and your key apps, plus a spreadsheet for decisions and sign-off, work well. Microsoft Entra access reviews require additional licensing as of 2026.
The exported user lists, each manager’s keep, change or remove decisions, the changes made, and the sign-off with dates. Insurers and client auditors often ask for this.
