Client area

IAM-07, Privileged access review

Complete trace of a fictitious client engagement.

Read only

Partially supported

Client: European client A
Contract: SEC-ANNEX-02, §7.4
Response: A quarterly review covers privileged accounts.
Residual risk: Supplier accounts remain outside the scope of the attestation.

4P trace

Quarterly review of all privileged accounts.

IAM-POL-03 §5 sets out the frequency and the responsible party.

Employees are reviewed; suppliers are left out.

The exports make it possible to cover both populations.

Action	Owner	Expected evidence	Status
Extend the Q3 review to service provider groups	IAM Owner	Validation signed	In progress