Does your organization have a formal process to request, track, review, and fulfill access requests that includes appropriate approval from system or data owners?

This question assesses whether your organization has implemented a structured access management process that governs how users obtain new or additional system access. A formal process ensures that access is granted based on legitimate business needs, receives proper authorization, and maintains an audit trail of requests and approvals. Evidence could include documentation of your access request workflow such as a formal access management policy, screenshots of your ticketing system showing access request workflows, sample access request forms with approval fields, or process diagrams showing the request-to-fulfillment lifecycle with approval gates.