6 min read
How to run quarterly user and admin access reviews for SOC 2 & ISO 27001
Replace manual CSV exports with a structured quarterly review of Global Admins, Super Admins, dormant accounts, external guests, and OAuth grants.
What auditors actually look for in an access review
SOC 2 (CC6.2, CC6.3) and ISO/IEC 27001:2022 (A.5.18, A.8.2) require evidence that privileged roles, active user accounts, external guests, and third-party API tokens are reviewed on a recurring schedule—and that revocations actually happened.
Four questions every quarterly review must answer
1. Are all Global Administrators and Super Admins still in an active role requiring that privilege? 2. Are any active member accounts lacking MFA or dormant for more than 90 days? 3. Do external guest accounts still belong to active partner engagements? 4. Have any unverified third-party OAuth apps been granted high-risk scopes?
Free tool
See SOC 2 CC6 & ISO 27001 A.5.18 mappings →No sign-up required. Free Pistos Pharos utility.