Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access list(s) for privileged accounts?

This question is asking whether your organization has documented processes for reviewing and updating who has privileged access to your systems, and whether you're actually following these processes. Privileged accounts are those with elevated permissions beyond regular users - such as administrator accounts, root access, database admin accounts, or any account that can make system-wide changes. These accounts pose a significant security risk if compromised or misused. The security assessment is asking this because: 1. Privileged account management is a critical security control - these accounts can do the most damage if compromised 2. Access rights tend to accumulate over time ("access creep") when people change roles or leave the organization 3. Regular reviews ensure only appropriate personnel have privileged access 4. Many compliance frameworks (like SOC 2, ISO 27001, NIST) require periodic access reviews To best answer this question: - Describe your documented process for reviewing privileged access - Mention the frequency of reviews (quarterly, semi-annually, etc.) - Explain who is responsible for conducting these reviews - Note how changes are tracked and implemented - Provide evidence that the process is actually being followed (not just documented)