Access reviews are periodic campaigns that verify employees have appropriate access to your organization’s critical systems. LowerPlane’s access review module helps you define critical systems, launch review campaigns, and track the certification of individual access grants — a core requirement across ISO 27001, SOC 2, HIPAA, and PCI-DSS.
The applications, databases, and infrastructure components that require formal access certification. You define which systems are critical and track their users.
Review Campaigns
Time-bound campaigns where designated reviewers certify or revoke access for employees across one or more critical systems.
Review Items
Individual access grants within a campaign. Each item represents one employee’s access to one system, requiring an approve or revoke decision.
Reviewers
The people responsible for certifying access. Typically system owners, managers, or security team members assigned by role.
For each review item, the reviewer has three options:
Approve — confirm that the access is appropriate and should continue
Revoke — flag the access for removal (triggers the access revocation process)
Escalate — flag for further investigation by a senior reviewer
Pay special attention to access that has not been used recently. If an employee has not accessed a system in over 90 days, consider whether they still need that access.
Access reviews track multi-factor authentication (MFA) and single sign-on (SSO) status for employees:
MFA Enabled — whether the employee has MFA configured for the system
SSO Enrolled — whether the employee accesses the system through SSO
Employees with access to critical systems who do not have MFA enabled should be flagged for immediate remediation. MFA is a baseline control required by all major compliance frameworks.
