Access Reviews in User Portal
Access Reviews (AR) are periodic checks to ensure that only authorized users can access Workspaces within myDRE. They allow Accountable and Privileged members to review and confirm user permissions. Access Reviews unburden the Workspace Accountable and the organisations in their requirement to stay compliant with rules and regulations around Access management.
Access reviews are implemented to ensure compliance with ISO27001 standards. These reviews help safeguard sensitive information by limiting access to authorized individuals only, in line with the principles of least privilege and role-based access control. For more detailed guidance, refer to anDREa ISMS documentation on the risks identified and the controls. The AR is triggered automatically based on a pre-set schedule, which can be one-time, weekly, monthly, quarterly, bi-annual, or annual. However, local Research Support (RS) members can also start an AR on an ad-hoc basis. Once an AR is activated, Accountable and Privileged members will receive email notifications with links to the relevant workspace(s). Inside the workspace's Members Tab, they can review member access by selecting options like Approve, Restrict, or Delete, and can confirm or approve access for all users at once to finalize the review.
How it works
The system triggers the initiation of access reviews on January 15th and July 15th. After the Access Review is initiated, the Accountable and Privileged members of the workspace will receive an email notification to review the member list. If members are not reviewed within the time frame provided (Enforcement) in the email, their access will be restricted to only the Members tab and the Details page in the workspace.
If the Workspace Accountable does not complete the access review before the specified due date (Enforcement), the system will automatically place all members who have not been reviewed into a Restricted state. To avoid this automatic enforcement, ensure that all access reviews are finalized promptly within the given timeline.
If you have been Restricted, please contact the workspace Accountable that can be found in the Members or Details page of the workspace to restore your access.
Let’s see how this works in practice:
- Access the workspace you are a member of and go to the Members tab > Access Reviews. The image below shows "No active access review found for workspace ". This is normal if the AR has not been initiated.
- When an AR is initiated, the notification email will include the workspace name. Open the workspace mentioned in the email, and under the Members tab, you will see the following:
- Members under review will have a question mark displayed next to their name during the review process. They are also listed on the Access Reviews tab until their role is confirmed.
- No question mark for the Accountable, meaning that the Accountable is not under review.
If a user is added to the workspace after the Access Review has been initiated, they will not be included in the Access Review.
Access Review performed by Workspace Accountable or the Privileged member
- In the Access Review, only the Accountable or the Privileged members can manage access for others. They can approve, restrict, or remove access, and there is an option to approve access for all members at once to complete the review.
- To restrict a member, read and confirm the restriction in the pop-up window.
- Restricted members have limited access. They can only view the Workspace and information about other members.
If you have been Restricted, please contact the workspace Accountable that can be found in the Members or Details page of the workspace to restore your access.