Access Control Review

Overview

Evaluate access control risks including user access management, privileged access governance, segregation of duties (SoD) conflicts, and access certification effectiveness. This skill applies the FFIEC IT Examination Handbook (Information Security booklet), NIST Cybersecurity Framework (PR.AC), SOX Section 302/404 requirements for IT general controls, and COSO Principle 11 (general controls over technology) to assess the adequacy of logical access controls in financial institutions.

When to Use

• Reviewing user access provisioning and de-provisioning processes
• Assessing privileged access management programs (PAM)
• Identifying and remediating segregation of duties conflicts
• Evaluating access certification/recertification campaigns
• Analyzing access-related audit findings or regulatory examination results
• Assessing access controls as IT general controls (ITGCs) supporting SOX-relevant applications

Required Inputs