Match accounts to people and purposes
Begin with the systems in the assessed environment. Identify interactive users, privileged accounts, service accounts, and external collaborators where relevant. For each, ask who approved the access, what work requires it, and who is responsible for keeping it appropriate.
Compare the roster with current personnel and business relationships. Investigate unexpected, shared, stale, or unexplained accounts. Do not remove an unfamiliar service account without understanding its operational purpose and obtaining the appropriate change approval. The review should improve control while preserving the business’s ability to operate.
Check permissions as a separate question
Authorization to log in does not answer which transactions or functions an identity may perform. Look at application roles, administrative privileges, shared-resource access, and other relevant permission boundaries. Ask whether the person’s current duties support that access.
Pick a role change and trace the before-and-after permissions. For example, a fictional employee moving from contract delivery to a different department may need different access even though employment continues. Record the decision and the actual change. A signed personnel form is useful context, but the system’s permissions still need to reflect the approved decision.
Walk through a departure end to end
Ask who starts offboarding, which systems are checked, who performs each action, and how completion is verified. Consider remote access, identity providers, application accounts, external sharing, physical access devices, and business-owned equipment where applicable.
Use a recent departure as a practical exercise, with an authorized reviewer and appropriately controlled records. If one system was missed, correct it and investigate the process failure. Avoid assuming that disabling one central identity automatically removes every kind of access. Verify the actual integrations and any independent accounts in the environment.
Keep evidence useful and limited
Record the systems reviewed, review date, reviewer, decisions, and follow-up work. Reference the controlled source records rather than distributing complete personnel or permission exports unnecessarily. Document unresolved items clearly and check closure after the implementation changes.
FAR 52.204-21 addresses access and identity requirements; the specific review format suggested here is an operating method, not a mandated template. Use the formal objectives when assessing the result. For broader preparation, return to the Level 1 self-assessment guide.
Sources & further reading
- FAR 52.204-21: the basic safeguarding clause ↗
- 32 CFR 170.15: Level 1 self-assessment ↗
- NIST SP 800-171A, June 2018: assessment procedures ↗
Published October 24, 2026. Government and company references were checked while preparing this page. General information and practical workflow suggestions; confirm the requirements and services that apply to your organization.
