Xcavate Access Recertification Checklist

Aligned with NIST SP 800-53r5, SP 800-12r1, and FCA compliance. This supports the “Protect” function under the NIST CSF, specifically the PR.AA category (IM, Authentication, and Access Control

Purpose: To ensure users retain only the minimum necessary access, reducing risk of unauthorized access to sensitive systems and data. Frequency: Quarterly or per regulatory/compliance need Owner: Security/IT Risk Team

Section A: Preparation

Task	Completed (Y/N)	Notes
Export user access list from IAM system
Identify all in-scope systems (critical/sensitive applications)
Define recertification scope (e.g., departments, access level)
Notify managers of upcoming access review		Include deadline for response
Confirm review responsibilities (line manager, data/system owner)

Section B: Review

Task	Completed (Y/N)	Notes
Review if access aligns with current job role
Verify if access follows the principle of least privilege
Identify and remove stale/inactive accounts
Confirm all privileged/admin accounts are still required
Cross-check against recent org chart or HR data

Section C: Approval & Revocation

Task	Completed (Y/N)	Notes
Log approvals from line managers and/or system owners
Submit list of access revocations to IAM administrators
Confirm removal of unapproved access rights		Include timestamp/log ID
Update IAM register or audit logs
Notify affected users of any access changes

Section D: Exception Handling

Task	Completed (Y/N)	Notes
Record business-justified exceptions		With approval from risk owner
Document timeframe for exception access		Include review/expiry date
Add flagged exceptions to quarterly risk log		For internal/external audit

Section E: Audit Trail & Reporting

Task	Completed (Y/N)	Notes
Archive completed recertification checklist		Store in secure location
Generate summary report for audit/regulatory purposes		Include percentage of removals
Submit report to Risk/Compliance lead and DPO

Reminders:

• Automated tools (e.g., SailPoint, Azure AD, Okta, etc.) can be used for tracking and alerts.

• Privileged accounts should be subject to more frequent review.

• Segregation of duties (SoD) should be checked during the review.