5.6 Access Reviews, Monitoring & Enforcing Technical Controls
Key Takeaways
- Indicator IV.C.3 requires ensuring that access controls and data classifications remain appropriate AND effective — the verification duty is continuous, not a one-time implementation check.
- Privilege creep is the default state of any organization: role changes add entitlements and rarely remove them, so periodic recertification is the standard control.
- A recertification that approves 100% of entitlements is evidence of rubber-stamping, not of correct access — reviewers need context and a real removal path.
- Detective controls complete the picture: access logging, alerting on anomalous access to sensitive records, DLP, and privileged-session monitoring.
- Monitoring employee activity is itself processing that needs a lawful basis, transparency, proportionality and often a DPIA or works-council consultation.
Controls Decay Unless Something Checks Them
Competency IV.C is the verification competency, and its third indicator is precise: ensure applicable access controls and data classifications are appropriate and effective. Two adjectives, two different tests. Appropriate asks whether the control matches the sensitivity of the data. Effective asks whether it is actually working right now.
The reason this is a standing duty rather than a project task is that access decays in a predictable direction. Nobody's entitlements shrink on their own.
Privilege creep
An employee joins support and gets support access. They move to billing and get billing access — support access is rarely removed, because removing it might break something. Two years and three moves later they hold the union of every role they have ever held. This is privilege creep, and it converts a routine phishing compromise into an enterprise-wide data exposure.
The defences are unglamorous and testable:
| Control | What it does |
|---|---|
| Joiner-mover-leaver process | Provisions on join, re-baselines on move (not adds), revokes on leave |
| Role-based entitlement model | Access attaches to a role definition, so a move swaps the role rather than layering it |
| Periodic recertification | A named reviewer confirms or revokes each entitlement on a defined cadence |
| Automated deprovisioning | HR system triggers revocation on termination, closing the leaver gap |
| Orphan-account detection | Finds accounts with no active owner — contractors, service accounts, shared logins |
The mover case is the one organizations handle worst, and the credited answer to a privilege-creep scenario is re-baselining on role change rather than tightening the joiner or leaver step.
Making recertification mean something
A recertification campaign that returns a 100% approval rate has not validated access; it has documented that reviewers clicked approve. Four design choices separate a real review from a ritual:
- Right reviewer. The business manager who knows what the person does, not IT, which knows only what the entitlement is called.
- Readable entitlements. "Can view customer payment details" rather than
SVC_FIN_RW_PROD_02. - Usage context. Show last-used dates; unused entitlements are the easiest to revoke honestly.
- A real removal path. Revocations must actually execute, with a tracked completion rate.
Risk-tier the cadence rather than reviewing everything quarterly: privileged and special-category access on a short cycle, standard business access annually, low-risk access on change only.
Detective controls
Preventive controls decide who may access; detective controls reveal what actually happened.
- Access logging on sensitive records, with sufficient retention to support an investigation.
- Anomaly alerting — a support agent viewing 400 customer records in an hour, access to a celebrity or executive record, out-of-hours bulk export.
- Data loss prevention on egress channels: email, upload, removable media.
- Privileged session monitoring for administrative access to systems holding personal data.
- Classification drift detection — sensitive data appearing in a store classified as internal, which is a IV.C classification-effectiveness failure rather than an access failure.
Break-glass access
Emergency access is legitimate and must be governed rather than forbidden: pre-approved accounts, activation with a stated reason, automatic time limits, alerting to a second person on activation, and mandatory after-the-fact review of everything the session touched. Break-glass without review is simply a standing back door with better paperwork.
Monitoring employees is processing too
This is the nuance the CIPM likes to test. Access monitoring generates personal data about employees, so it must satisfy the same discipline the program applies elsewhere: a lawful basis (typically legitimate interests, supported by an LIA), transparency through an employee-facing notice describing what is monitored and why, proportionality — monitor access to personal data rather than keystrokes and private messages — a DPIA where monitoring is systematic and extensive, consultation with works councils or employee representatives where local law requires it, and a retention limit on the monitoring data itself. An organization that deploys covert, unlimited employee monitoring to protect customer privacy has traded one violation for another.
Worked scenario
A hospital discovers a nurse accessed the records of a neighbour who was never their patient. Access was technically authorised — the role permits viewing any patient record — so no preventive control failed. What failed was verification and detection: no relationship-based access rule, no alerting on access without a care relationship, and no periodic review of whether "any patient" was still an appropriate scope for that role. The credited remediation pairs a narrowed access model with break-glass for genuine emergencies, anomaly alerting, and a recertification cycle that revisits scope — exactly the appropriate and effective pairing indicator IV.C.3 names.
An employee who has moved through support, billing and operations roles is found to hold the combined entitlements of all three. Which control most directly addresses this pattern?
A privacy manager proposes deploying continuous monitoring of employee access to customer records, including alerting on anomalous access patterns. What does the CIPM expect the manager to recognise?