What is an access review and when should it be conducted?

• A. A quarterly periodic certification of user access by owners; ensures only authorized privileges remain.
• B. An annual password reset reminder.
• C. A process that creates new user accounts automatically.
• D. A security incident report about access logs.

Answer: (A)

Access reviews verify who currently has access to systems and data and confirm that each entitlement matches the user’s role. Owners or data/app owners run these reviews to certify that privileges are appropriate and revoke any that are no longer needed, helping enforce least privilege and reduce risk. They are typically done on a regular cadence, commonly quarterly, though they can be prompted by role changes, terminations, or audit requirements. The option describing a quarterly, owner-led certification best captures both the process and the timing. Other choices point to password reminders, automatic provisioning, or incident reports, which are not about validating existing access rights.