Run a quarterly access review

Control principle

Access should match a current role, approved purpose, and accountable owner.

Roles have changed, contractors have come and gone, or the team cannot explain who can see, export, change, or delete important records.

Use it in the active service

Start with these controls

1. Inventory privileged, standard, integration, shared, service, vendor, and dormant identities.
2. Ask the accountable owner to confirm purpose, role, data scope, authentication, and required duration.
3. Remove, reduce, or time-limit access that is no longer justified and record exceptions with an expiry date.
4. Verify joiner, mover, leaver, emergency, and recovery procedures against recent staffing changes.

Pause point

Do not let operating pressure erase nonprofit ownership

Qualified security, privacy, HR, legal, or sector review may be required for sensitive systems and high-impact access decisions.