# Access Review Log

> **Template — adapt before use.** Use one log per review cycle and per system (or consolidate). The completed, signed log is your audit evidence for periodic access review.

| | |
|---|---|
| **System / application** | [name] |
| **Review period** | [e.g. Q3 2026] |
| **Reviewer** | [Name / Role] |
| **Date performed** | [YYYY-MM-DD] |

Satisfies: ISO 27001 A.5.18 / A.8.2 · PCI DSS Req 7 · SOC 2 CC6.2–6.3 · HIPAA §164.308(a)(4).

## Review scope
- [ ] Standard user accounts
- [ ] Privileged / admin accounts
- [ ] Service / machine accounts
- [ ] Joiners / movers / leavers since last review

## Findings
| User / account | Role | Access level | Still appropriate? | Action taken | Date |
|---|---|---|---|---|---|
| [user] | [role] | [level] | Yes / No | [none / revoked / reduced] | [date] |
| | | | | | |
| | | | | | |

## Summary
- Accounts reviewed: [n]  · Changes made: [n]  · Dormant disabled: [n]
- Issues / exceptions: [describe or "none"]

## Sign-off
Reviewer: ______________  Date: __________
System owner: ______________  Date: __________