Data access certification

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

1. 1.Confirm the certification procedure defines the customer-data domains in scope and the semi-annual cadence.PR.AA-05
2. 2.Confirm reviewer independence from the access being certified.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

1. 1.Select 25 users with access to customer data domains and confirm each was certified in the period.
2. 2.Verify access removed during certification was deprovisioned within SLA.PR.AA-01
3. 3.Confirm exceptions were tracked to remediation.

Linked risks

• Customer data breachmitigation 3

Framework mappings & latest test