Topic starter
05/07/2026 6:50 pm
TL;DR: ISO 27001 Control A.9.2.5 requires access reviews at intervals appropriate to risk, and Zluri argues that annual, spreadsheet-driven cycles often fail because they lack documented rationale, continuous improvement evidence, and complete coverage. Convenience-based cadences do not satisfy auditors when high-risk access is involved.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “ISO 27001 User Access Review (How to Move From Convenience-Based to Risk-Based Frequency)”.
Key questions
Q: What breaks when ISO 27001 access reviews are set by convenience instead of risk?
A: The control becomes hard to defend because the organisation cannot show that review intervals follow the documented risk assessment.
Q: Why do high-risk access reviews need more justification under ISO 27001?
A: Because the standard expects intervals to be appropriate to the risk, not chosen by default.
Q: How do security teams know when access review processes are not enough?
A: When reviews are happening but high-risk access, role creep, or orphaned accounts keep reappearing, the programme is checking records rather than controlling outcomes.
Practitioner guidance
- Define review cadence by risk tier Classify systems and access paths by asset criticality, privilege level, user population, and breach impact, then assign each tier a review interval that is documented in the ISMS.
- Document the rationale for every interval Write down why monthly, quarterly, semi-annual, or annual reviews are appropriate for each access population so auditors can trace the decision back to the risk assessment.
- Track PDCA evidence across cycles Measure review effort, violations found, remediation time, and process changes so the next cycle shows actual improvement rather than a repeated workflow.
Bottom line: ISO 27001 access review frequency is defensible only when it follows documented risk, not calendar convenience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:09 pm
Risk-based frequency is the control, not the calendar. ISO 27001 access reviews succeed when the review interval follows the risk of the access being governed. Annual or quarterly cadence is only defensible when it is tied back to a documented risk assessment, and that applies differently to customer data, privileged production access, contractors, and service accounts. The implication is that review frequency is part of control design, not an administrative preference.
A question worth separating out:
Q: Should organisations include service accounts in ISO 27001 access reviews?
A: Yes. Service accounts are access-bearing identities and can carry elevated privileges, long-lived credentials, and hidden dependencies that create real exposure. Excluding them leaves a gap between the control requirement and the actual identity estate. They should be reviewed with the same completeness discipline as user accounts.
👉 Read our full editorial: ISO 27001 access review frequency must track risk, not convenience