iKNSA Client area
IAM-07, Privileged access review
Complete trace of a fictitious client engagement.
IAM-07, Privileged access review
Partially supported- Client
- European client A
- Contract
- SEC-ANNEX-02, §7.4
- Response
- A quarterly review covers privileged accounts.
- Residual risk
- Supplier accounts remain outside the scope of the attestation.
4P trace
Promise
Quarterly review of all privileged accounts.
Policy
IAM-POL-03 §5 sets out the frequency and the responsible party.
Practice
Employees are reviewed; suppliers are left out.
Platform
The exports make it possible to cover both populations.
Evidence
| Evidence | Source | Scope | Verification | Expiry |
|---|---|---|---|---|
| IAM-Q2-export.csv | IAM platform | Privileged employee accounts | Reviewed by iKNSA | 30 September |
| IAM-POL-03.pdf | Policies | Access review process | Verified within scope | — |
Remediation assigned
| Action | Owner | Expected evidence | Status |
|---|---|---|---|
| Extend the Q3 review to service provider groups | IAM Owner | Validation signed | In progress |
History
| Event | Subject | Consequence | Actor | Date |
|---|---|---|---|---|
| Evidence reviewed | IAM-Q2-export.csv | 1 confirmed engagement | iKNSA reviewer | 12 August |
| Drift detected | MFA coverage | 3 engagements to review | Continuous monitoring | 11 August |