What is the best way to handle access reviews for disconnected systems?

How to make access reviews trustworthy when the system cannot be queried live

The core problem with disconnected systems is not the review itself, but the evidence quality. If the review is driven only by a prior certification record, you can end up recertifying access that no longer exists, or missing access that was added after the last sync. The review should therefore start with current system evidence, then use the governance record as the reconciliation target.

In practice, that means collecting local account exports, group membership, privilege assignments and relevant application logs from the disconnected system, then mapping those results back to the identity governance record. That is the same operational logic used in IAM and IGA Basics, where access review is treated as a governance process that must reflect actual entitlements, not just workflow state.

For disconnected environments, the review should be evidence-led, time-bounded and repeatable. The useful question is not “who was approved last quarter?” but “who has access right now, and what proof do we have that this state was accurate at the moment of review?”

What evidence matters most in a disconnected access review

The most reliable evidence is the evidence the system itself can produce. Local account listings, nested group membership, privilege tables, role mappings, sudo or admin lists, and application audit output are usually more defensible than spreadsheets or manually curated entitlement extracts. If the system is sensitive enough to warrant privilege review, logs should also be checked for dormant, shared, or recently elevated accounts.

This is especially important when the system behaves more like a managed identity surface than a standard app. NHIMG’s NHI Lifecycle Management Guide is useful here because the same lifecycle discipline applies to disconnected accounts: identify them, verify their current authority, and remove stale access as part of the review loop.

Where access is handled through privileged accounts, the evidence set should be stricter. For example, privileged group membership and break-glass access need more scrutiny than ordinary read access, because a stale admin account can survive long after the business justification has ended.

How to run the review without a live connector

When no API or live connector exists, the safest approach is a controlled extract process. Schedule the export, define who is allowed to run it, lock the format, and preserve the raw output so reviewers can see what was actually collected. If possible, keep the extract timestamp close to the attestation window so the review does not drift away from the system state.

The control objective is to keep the review auditable even though the system is disconnected. NHIMG’s Access Reviews and Certification Guide is directly relevant because it frames access certification as a decision process, not a checkbox exercise, and emphasizes closing the loop after reviewers act.

In larger environments, it is usually better to review smaller, higher-risk slices more often than to batch everything into a single annual campaign. That reduces reviewer fatigue and makes it easier to spot access that was inherited, duplicated, or never retired after a role change.

Risk and Threat Considerations

Disconnected systems often create blind spots because the review process depends on snapshots, manual exports, or delayed synchronization. That creates two risks: access may be approved after it has already changed, or stale access may persist because nobody can verify the live state quickly enough. In adversarial terms, disconnected systems can also hide dormant accounts, excessive privilege and orphaned access longer than connected systems.

Failure mechanism: The certification record becomes the source of truth instead of the system’s current access state, so reviewers validate outdated entitlements and miss changes that happened after the last extract.

Impact: Excess access can remain in place, revocation can be delayed, and an attacker or insider may have a longer window to exploit stale privileges without detection.

Practitioner Guidance

What to verify: Verify that every review packet is built from raw system evidence, not from a prior approval report. If the extract does not show the full current set of accounts and privileges, treat the review as incomplete rather than “good enough.”

Decision rule: If the disconnected system can produce local exports but not a live connector, use a controlled extract plus attestation workflow. If you cannot obtain current evidence at all, downgrade the confidence of the review and escalate the gap as a control deficiency.

Practitioner takeaway: The best disconnected-system review is one that proves current access first and governance second, because certification without fresh evidence is only documentation, not assurance.

Related resources from NHI Mgmt Group

• How should security teams handle access reviews for financial reporting systems?
• Why do access reviews fail when identity systems are disconnected?
• How should identity teams handle access reviews when evidence is scattered across multiple systems?
• What is the best way to handle Slack messages and guest accounts that no longer need access?