How to Complete an Access Review

Not-for-profit organisations are responsible for the security of sensitive data about their organisation, supporters and the people they serve. Whether through phishing attacks or account compromise, cyber criminals will try to gain access to the organisation’s data. The more access a single account has, the more data is at risk if that account is compromised by cyber criminals.

To combat this challenge, organisations should complete an access review to ensure that only authorised people and services have access to their systems and data, and that each account has only the privileges it needs.

How often you complete this process depends on the size and complexity of your organisation and your digital systems. We recommend completing the process at least once every 6 months. If your organisation changes frequently, you may need more regular reviews, which also reduce the workload of each review. You can also trigger a review on specific events, such as staff or guest onboarding or offboarding.

Preparing for a review

There are 3 key elements needed to complete a review:

• Asset register: a list of systems to review. This should include all systems used by your organisation that store confidential or sensitive data and may include details of purchase date, warranty period (if applicable), asset owner and any other relevant data. This information could be captured in a Digital Asset Register.
• Asset owner: the person responsible for the asset or system and the data it contains. Ideally this person should be the one completing the review for their system. Alternatively, this person should approve any recommended changes during the review process.
• Access control and permissions: understanding and managing access controls, permission levels and role-based access within each system, aligned with the principles of least privilege and need-to-know access. This includes defining what users, administrators and privileged roles are authorised to view, create, edit, delete, share, download and export, and ensuring access is appropriate to their role and business requirements.

Completing the review

Complete these steps for each system you’ve identified for review.

1. Export a user list.

Gather a report of every user in the system and their current access, including staff, external parties and service accounts. How you do this depends on the system. Make sure the list also includes automation accounts and any shared or generic accounts.

2. Remove “ghost” accounts.

These are old accounts for users who no longer require access and should be disabled first, then removed completely once you’ve confirmed that no legacy processes, automations or integrations rely on them. Retaining these accounts is a risk to the organisation as they aren’t actively managed by a user and can be vulnerable to hacking by cyber criminals. Compare accounts with a current list of staff from your human resources department.

3. Review guest accounts.

Confirm that each guest still needs access to your environment.

4. Adjust permissions for active users.

Review the permissions of each remaining account to make sure its level of access matches the role it’s used for.

Remember to apply the “principle of least privilege” – keep permissions to the lowest level required. This ensures that access to sensitive data and systems is kept to only those who truly need it, which in turn reduces the risk for the organisation by minimising the exposure of your organisation’s data and systems.

This is especially relevant if a user has an artificial intelligence (AI) subscription or agent that inherits the same permissions as their account and can surface content the user may not be aware they have access to.

Apply permissions based on the security groups configured in your productivity suite, such as Google Workspace or Microsoft 365, to streamline this process, as you’ll have a single source of truth for your accounts and permissions.

5. Separate accounts with administration privileges.

Current best practice advises that users who require administration privileges should have accounts protected by phishing-resistant multi-factor authentication (MFA) separate from their day-to-day accounts to carry out administration tasks.

This reduces the potential impact of account compromise in several ways, such as critical assets being deleted by mistake, attackers turning off key security features or malware doing things it couldn’t otherwise do with a lower-privilege account.

Review accounts with administration or elevated privileges as their own group, so they get proper attention.

6. Verify security settings.

Confirm that each account has the appropriate security controls configured, such as minimum password requirements, MFA and geo-blocking. Please note: these controls may be set as security settings or as access policies within your environment.

Depending on the structure of your organisation, you may need to get approval or sign-off from a senior leader before applying the recommended security changes. We recommend keeping a log of the changes for audit purposes.

Once you have a list of changes that need to be made, apply those changes to the relevant system.

Keep your data in the right hands

Regular access reviews protect your organisation and staff members by ensuring each person has only the access needed for their role. They help identify outdated accounts, excessive permissions and inappropriate access before these weaknesses can unintentionally cause harm or be exploited by cyber criminals.

By making access reviews a routine process and acting on the findings, you reduce the likelihood and potential impact of account compromise, unauthorised access, misconfiguration and accidental data loss. Keeping a record of decisions, approvals and completed changes also provides clear evidence that access is actively managed and reviewed.