Overview
Access reviews are periodic campaigns that verify employees have appropriate access to your organization’s critical systems. LowerPlane’s access review module helps you define critical systems, launch review campaigns, and track the certification of individual access grants — a core requirement across ISO 27001, SOC 2, HIPAA, and PCI-DSS.Key Concepts
Critical Systems
The applications, databases, and infrastructure components that require formal access certification. You define which systems are critical and track their users.
Review Campaigns
Time-bound campaigns where designated reviewers certify or revoke access for employees across one or more critical systems.
Review Items
Individual access grants within a campaign. Each item represents one employee’s access to one system, requiring an approve or revoke decision.
Reviewers
The people responsible for certifying access. Typically system owners, managers, or security team members assigned by role.
Critical Systems
Before launching access reviews, you must define the critical systems in your organization.Adding a Critical System
1
Navigate to Critical Systems
Go to Personnel > Access Reviews and select the Critical Systems tab.
2
Click Add System
Click Add Critical System and fill in the details.
3
Define System Properties
Provide the following information:
4
Add Users
Add employees who have access to the system. For each user, specify their access level and grant date.
System Categories
Access Review Campaigns
Creating a Campaign
1
Navigate to Campaigns
Go to Personnel > Access Reviews and select the Campaigns tab.
2
Create New Campaign
Click Create Campaign and configure:
3
Launch Campaign
Save the campaign to generate review items for all in-scope employees and systems. The campaign enters Active status.
Campaign Types
Campaign Statuses
Review Items
Each review item represents one employee’s access to one system within a campaign.Review Item Fields
Making Decisions
For each review item, the reviewer has three options:- Approve — confirm that the access is appropriate and should continue
- Revoke — flag the access for removal (triggers the access revocation process)
- Escalate — flag for further investigation by a senior reviewer
Campaign Metrics
Each campaign tracks completion metrics:MFA and SSO Status
Access reviews track multi-factor authentication (MFA) and single sign-on (SSO) status for employees:- MFA Enabled — whether the employee has MFA configured for the system
- SSO Enrolled — whether the employee accesses the system through SSO
Compliance Mapping
Access reviews satisfy controls across multiple frameworks:Best Practices
- Run access reviews at least quarterly for critical systems and annually for all systems
- Assign system owners as reviewers — they have the best understanding of who needs access
- Track revocation follow-through — a revoke decision in the review must be followed by actual access removal in the system
- Use termination campaigns immediately when an employee departs to verify access is fully revoked
- Document review decisions with notes explaining the rationale, especially for unusual access patterns
- Automate recurring campaigns by setting a frequency on the campaign to auto-generate the next review cycle