How often should you review user access?

There is no single required interval. NIST SP 800-53 AC-2 says to review accounts at a defined frequency and leaves the number to you. A defensible approach is quarterly for privileged and production access, and at least annually for the rest, then following your own schedule.

Why the number is yours to choose

Frameworks tend to ask for a documented, risk-based review cadence rather than a fixed one. Your auditor or customer will check two things: that your policy states a frequency, and that you have evidence of reviews happening at that frequency.

A schedule you set and keep beats a stricter one you skip.

Tier systems by risk

Not every app needs the same attention. Sort systems into three groups:

• High: production infrastructure, cloud consoles, identity provider admin, source control admin, databases with customer data, finance systems.
• Medium: internal tools that hold business data.
• Low: tools with no sensitive data, such as a design whiteboard.

A workable cadence is quarterly for high, twice a year for medium, annually for low. Adjust to your size. A team of ten can review everything quarterly in an hour.

Review privileges separately

AC-6(7) in the same catalogue asks for periodic review of assigned privileges to confirm they are still needed, with reassignment or removal where they are not. That is a different question from "does this person still work here". Check both.

Admin rights go stale fastest. They get granted for a project and never leave. Reviewing them more often is cheap and high value.

Make the review produce evidence

A review that leaves no record did not happen, as far as an auditor is concerned. For each review keep:

1. The list of accounts and permissions reviewed, with the date and who exported it.
2. The reviewer, who should not be the person whose access is being reviewed.
3. Decisions: keep, change, remove.
4. Proof that removals were carried out.

A spreadsheet works. Screenshots of an admin page rarely do, because they cannot show what was changed afterward.

Also trigger reviews by events

Calendar reviews miss things. Add event triggers: a reorganisation, a security incident, an acquisition, a long leave, or a contractor project ending. These are the moments access most often drifts from need.

A simple starting plan

1. Inventory systems and assign each an owner and a tier.
2. Put review dates in the owner's calendar.
3. Give owners an export of users and roles one week before.
4. Collect decisions, apply removals, attach proof.
5. Report the number of removals to your security steering group. A review with zero changes, repeated every time, deserves a second look at how carefully it was done.

Safeguard's asset discovery and compliance evidence automation can help you find systems that were missing from the inventory and store review evidence in one place.

Quick check

Sources

• AC-2 Account Management, NIST SP 800-53 Rev. 5
• AC-6 Least Privilege, NIST SP 800-53 Rev. 5

Last reviewed: 19 October 2026.