A campaign exclusion is a deliberate decision to leave a user, account, application, or entitlement out of an access review. Exclusions should always be documented, justified, and linked to another control if one exists, so auditors can understand why the population outside the campaign was not reviewed.
What Campaign Exclusion Means in Access Review
Campaign exclusion is not the same as oversight or omission. It is a conscious scoping choice that removes a user, account, application, or entitlement from a specific review cycle because another control, business rule, or documented exception already governs that access.
The term matters because access review quality depends on evidence of what was reviewed and what was intentionally left out. A valid exclusion preserves review integrity only when it is explicit, time-bound where appropriate, and defensible to auditors or control owners.
Why Exclusions Change the Meaning of a Review
An access review campaign is only as complete as its scope. If exclusions are not tracked, the review can appear to have covered the full population while actually skipping material access, which weakens certification results and obscures residual risk. That is why exclusions should be treated as part of the control record, not as informal housekeeping.
Good exclusions usually have a reason, an owner, and a linkage to the control that still covers the item outside the campaign. That linkage might be a separate privileged-access process, a compensating control, a lifecycle event, or a formal exception approved under policy.
Common Reasons a Campaign Exclusion Is Used
Teams exclude items when they are out of scope for the review period, already covered by a more appropriate control, or temporarily exempt because they are under remediation. In mature programs, exclusions are also used to avoid duplicate review of the same access path when that would create noise rather than stronger assurance.
Exclusions become problematic when they are used to make a campaign easier to complete rather than more accurate. Overuse can hide stale access, excessive privilege, orphaned entitlements, or applications that never get reviewed because they are repeatedly carved out.
How Campaign Exclusions Affect Auditability and Control Evidence
An exclusion is evidence-sensitive: if it is not documented, reviewers cannot distinguish a valid scope decision from a missed record. Clear documentation should show why the exclusion existed, who approved it, when it applies, and what other control covers the risk.
For auditors, the key question is whether the exclusion leaves a gap in assurance. If the answer is yes, the campaign is incomplete. If the answer is no, the exclusion should still be traceable so the control story remains coherent across review, exception handling, and remediation.
Risk and Threat Considerations
Campaign exclusions create risk when they remove accounts or entitlements from independent scrutiny without a compensating control that is actually operating. Over time, repeated exclusions can hide privilege creep, stale access, or unreviewed high-risk access paths.
Failure mechanism: The review misses a population that should have been assessed, and the missing segment is assumed to be covered elsewhere when it is not.
Impact: Excess access can persist undetected, certification evidence becomes incomplete, and the organisation can lose confidence in the access review as a control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Access review exclusions directly affect account lifecycle governance and review scope. |
| AC-6 — Least Privilege | Excluding entitlements from review can leave excessive privilege unchallenged. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Campaign exclusions must be traceable so review evidence remains auditable. | |
| Recommendation — Document excluded accounts and verify an alternate control still covers their access. Use least-privilege reviews to validate that excluded access remains justified. Retain exclusion records with rationale, approval, and compensating control evidence. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Campaign exclusions change how access rights are reviewed and governed. |
| Recommendation — Keep excluded access rights under documented governance and periodic revalidation. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Access review scope and exception handling are core access-control management duties. |
| Recommendation — Track excluded identities and ensure each exclusion has a compensating control. | ||
Practitioner Guidance
Governance implication: Treat exclusions as controlled exceptions, not convenience filters. Each exclusion should have a documented rationale, an accountable owner, and a clear statement of the alternate control or review process that covers the risk.
What to watch for: Repeated exclusions for the same population, broad exclusions with vague justification, and exclusions that are never revisited after the original campaign. Those patterns usually indicate scope drift rather than a sound control decision.
