Access Review Policy
Objective and Scope
This document describes access provisioning and access reviews for myDRE platform accounts, myDRE workspace memberships, and anDREa employee access. It defines review responsibilities, schedules, decision criteria, and enforcement outcomes.
It supports the linked A.05.15 Access Control, A.05.16 Identity Management, and A.05.18 Access Rights controls and must be read together with the associated access-management and personnel lifecycle procedures.
1. Access Management & Review: myDRE Platform
1.1 Account Provisioning & Lifecycle Governance
To reduce the risk of platform abuse and unauthorized account provisioning, myDRE user accounts are created only on request and provisioned by authorized anDREa Support personnel.
-
Request Channels: Account-creation requests may be submitted through System for Cross-domain Identity Management (SCIM) integrations or the official administrative portal. Submission of a request does not automatically create an account; provisioning requires authorized anDREa Support action.
-
Execution Boundary: Account provisioning is executed exclusively by authorized anDREa Support staff following the applicable request-validation and authorization procedure.
-
Privileged Identity Management (PIM): anDREa Support personnel must manually activate the required elevated role through PIM before performing privileged account-provisioning actions. Under anDREa's privileged-access procedures, these personnel activations must not be automated. Permissions assigned to service principals and managed identities are governed separately through the applicable access-control procedures.
1.2 Telemetry, Auditability, and Behavior Monitoring
Platform activity and security signals are collected through the configured Microsoft security monitoring services. Alert handling and escalation follow the applicable security-monitoring and incident-management procedures.
-
Security Signals: Relevant signals include repeated MFA failures, unusual sign-in behavior, and risky-user notifications.
-
Assessment: Authorized anDREa personnel assess relevant alerts on a case-by-case basis and determine whether investigation or protective action is required.
-
Scheduled Review and Documentation: The documented security-control review is performed every two weeks. Review results, relevant findings, decisions, and follow-up actions are recorded in the Periodic Security Controls register. Incident investigations and root-cause analyses, where required, are recorded through the applicable incident-management process.
-
Protective Actions: Depending on the assessment, actions may include temporary account restriction, user verification through an approved channel, or additional access restrictions. Urgent cases follow the applicable incident-management and escalation procedures.
-
Operational Cadence & Documentation: Telemetry logs and anomalous incidents are reviewed every two weeks. Findings, justifications, and root-cause analyses are explicitly logged within the Periodic Security Controls.
-
Remediation Paths: Verified risks prompt immediate protective actions, including temporary account restriction, out-of-band user verification, or advanced conditional blockades to contain potential account compromises.
1.3 Access Rights Management & Least Privilege Enforcement
-
Principle of Least Privilege (PoLP): Supplementary permissions beyond the baseline profile are denied by default. Entitlements are granted only where there is a documented operational need and are reassessed through scheduled reviews and relevant lifecycle events.
-
Revocation Thresholds: Elevated or additional access rights are assessed for restriction or revocation when they remain unused for extended periods or when applicable prerequisites, such as required training or signed agreements, have not been fulfilled within the required timeframe.
-
Audit Cadence: Access configurations are reassessed every two weeks and securely documented within the Periodic Security Controls ledger.
-
Cross-Reference: Operational details are described in the Overview User Management & Research Support.
2. Access Review Framework: myDRE Workspaces
2.1 Review Schedules and Cadence
Access validation within myDRE Workspaces utilizes a hybrid enforcement structure consisting of both automated platform triggers and ad-hoc supervisor controls:
- Twice-Yearly Reviews: The platform automatically initializes a formal, system-wide access review cycle twice a year on January 15th and July 15th.
- Ad-Hoc Reviews: Local Research Support (RS) teams maintain the authority to trigger out-of-band access reviews at any time to mitigate emerging project risks.
- Institutional Alignment: Local RS departments can configure localized periodic schedules tailored explicitly to the compliance cycles of their respective organizations.
2.2 Reminders, Timelines, and Automatic Restriction
When an access review starts, the system applies the relevant review deadline. Workspace members whose access has not been approved by that deadline are automatically assigned the Restricted role. This removes their ability to interact with workspace resources while retaining the limited visibility associated with that role. Starting with the first workspace access-review cycle that includes Accountables, planned for Q1 2027, this enforcement also applies to Accountables. Where an Accountable becomes Restricted, the client organization's Research Support is responsible for reviewing and resolving the Accountable assignment.
| Review Context | First System Reminder | Automatic Restriction Deadline |
|---|---|---|
| Ad-Hoc Review | 10 days prior to enforcement deadline | 15 days post-initiation |
| Bi-Annual Review | 55 days prior to enforcement deadline | 90 days post-initiation |
Platform Automation & Visual Indicators
- System-Triggered Inception: Bi-annual review cycles commence automatically on January 15th and July 15th.
- Targeted Notification Routing: Automated system notifications are dispatched directly via email to Accountable and Privileged members of active workspaces, appending the specific metadata and workspace contexts required for the review.
- Visual Telemetry: Identities currently under active review are tagged inside the workspace UI with a clear visual indicator (a question mark
?displayed next to their profile name) and are aggregated in the Access Reviews tab. - Accountable Role: Starting with the first workspace access-review cycle that includes Accountables, planned for Q1 2027, Accountables may approve their own continued access during the review window. If an Accountable has not approved their access by the deadline, they are assigned the Restricted role. The client organization's Research Support then reviews the situation and determines whether to reinstate the existing Accountable or appoint a replacement.
2.3 Review Decisions and Actions
Administrative actions within a workspace access review window can be executed exclusively by authenticated Accountable and Privileged members. Local Research Support (RS) members support the review architecture and can initiate standard review cycles.
Reviewers must review each flagged member and select the appropriate action before the deadline. Members who remain unapproved are subject to the automatic restriction rules in section 2.2.
Approve Selected
Use when the reviewer has confirmed that the user still requires access and that the assigned role remains appropriate. Approval retains the user's current workspace role.
Restrict Selected
Use when continued access to workspace resources is not justified. The user's workspace role changes to Restricted, removing the ability to interact with workspace resources while retaining the limited visibility defined in the myDRE Role Matrix. Automatic restriction following an uncompleted review is governed by section 2.2.
Delete Selected
Use when the user no longer requires membership of the workspace. This removes the user's workspace membership; it does not delete the user's myDRE platform account or historical audit records.
3. Access Review Framework: anDREa Corporate Employees
3.1 Corporate Governance Structure
Access governance for internal anDREa corporate environments, assets, and operational code repositories is managed through a strict organizational matrix:
- Management Team: Holds overall responsibility for corporate access governance and authorization.
- Asset Responsibles: Designated owners of digital assets, repositories, and information systems who review access at the defined intervals and following relevant lifecycle events.
3.2 Mandatory Governance Triggers
Corporate access is assessed and adjusted in accordance with the associated personnel lifecycle and access-management procedures when relevant changes occur:
- Onboarding: Grant access based on approved responsibilities and operational needs.
- Role Changes and Transfers: Reassess existing access, remove permissions no longer required, and authorize any additional permissions.
- Offboarding: Revoke access at the effective departure time or earlier where required by the applicable procedure.
- System Changes: Review affected access permissions when deployments, configuration changes, or migrations alter authorization requirements or access paths.
4. Standardized Review Criteria & Audit Guidelines
To ensure consistency across both localized myDRE Workspaces and internal anDREa corporate directories, all authorized reviewers must explicitly audit access permissions against the following core security criteria:
- Principle of Least Privilege (PoLP): Verify that all assigned user privileges are restricted to the minimum access required to complete designated operational functions.
- Role-Based Access Control (RBAC) Alignment: Ensure that assigned groups, security parameters, and repository rights accurately reflect the user's current corporate role or research mandate.
- Segregation of Duties (SoD): Identify conflicting permissions and address them through removal, separation of responsibilities, or documented compensating controls and approval under the applicable risk-management process.
- Inactive Users and Unused Access: Identify access that is no longer justified and restrict or remove it through the applicable access-management procedure.