# Quarterly Access Review

Period: ____  Reviewer: ____  Approver: ____

## 1. Scope
- [ ] List in-scope systems (cloud accounts, identity provider, source control, production databases, key SaaS).
- [ ] Export current users, roles, and groups from each system (save the export as evidence).
- [ ] Export non-human identities: service accounts, API tokens, CI/CD credentials, agent tokens.

## 2. Review
- [ ] Every account maps to a current employee, contractor, or owned service.
- [ ] Leavers since the last review have no remaining access.
- [ ] Privileged roles (admin, owner, production write) are still justified.
- [ ] Machine identities unused for 90+ days are flagged for removal.
- [ ] Shared accounts are documented with an owner and a reason.

## 3. Act
- [ ] Remove or reduce access for every flagged account; record ticket links.
- [ ] Rotate credentials for any identity whose owner changed.

## 4. Record
- [ ] Reviewer and approver sign-off with date.
- [ ] Exports, decisions, and tickets stored with the review.