Access Control Review
When people join and leave, their access to your systems should change with them. In many growing companies it depends on emails, spreadsheets and whoever remembers. This review shows who has access to what, how it gets added and removed, and whether there's a record of every change.
Who it's for
- Your company has several locations, brands or business units, and access spans more than one of them.
- New hires and departures are handled through emails, spreadsheets or whoever remembers.
- You're facing an audit, or an acquisition is about to make the setup harder to track.
- Nobody can answer "Does anyone who left still have access?" with confidence.
What I do
- Map how access is granted and removed today, from hire to exit, including who signs off and where it is recorded.
- Check a sample of key systems against recent departures to see whether access was actually removed.
- Find the gaps, such as a missing audit trail, shared accounts, access that never expires and steps that depend on one person.
This is a process and ownership review, not a security audit. It doesn't include penetration testing or compliance certifications such as SOC 2. If you need those, I'll help you scope the work and choose a specialist firm.
What you get
- A written map of your hire-to-exit access process, with the gaps marked
- A ranked list of fixes, starting with the biggest exposure
- A recommendation on whether a simple internal tool, an existing product or a process change is the right fix
Where this comes from
At a broadcasting company with about 2,000 employees across 75 business units, nobody could reliably track who held which access. A simple system with a full audit trail went into everyday use and saved about 100 hours a month.
The Access Control Review is $2,250 (three weeks, covering up to 10 key systems). If it shows you need more than a review, the 30-day audit or an ongoing engagement is the next step.