# CAIQ IAM-08: User access review By The Citesheet team · Published October 20, 2026 Short answer IAM-08 asks whether you review and revalidate user access, checking least privilege and separation of duties, at a frequency that fits your risk. Your access control policy proves that reviews happen. The frequency (often quarterly for production and annually for everything else) needs to be written down too, and the review needs a record such as a signed-off ticket. ## What the control asks **IAM-08.1:** Are reviews and revalidation of user access, for least privilege and separation of duties, completed with a frequency commensurate with organizational risk tolerance? In plain English: does someone regularly go through the list of who has access, confirm each person still needs it, and remove what they don't? The CAIQ leaves the frequency to you ("commensurate with risk"), but it expects you to have one. ## Which policy usually proves it The _Access Control Policy_, in an access review section. The best answers point to three things: the rule (reviews happen), the frequency (how often, for which systems) and the record (where the completed reviews are kept). ## Quoted evidence from public policies GitLab states the rule: > Access reviews are performed to confirm existing access. > > _GitLab Handbook, [Access Management Policy](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/access-management-policy/), CC BY-SA 4.0._ GitLab's [Records Retention & Disposal](https://handbook.gitlab.com/handbook/security/policies%5Fand%5Fstandards/records-retention-deletion/) also lists "System access reviews" as a record kept for 1 year 3 months, which is indirect evidence that the reviews produce a record. Tailscale ties the review to the movers problem from [IAM-07](https://citesheet.com/caiq/iam-07-user-access-changes-and-revocation/): > Since there could be delays in reporting changes in user responsibilities, periodic user access reviews are conducted by the Security Review Team. > > _Tailscale, [Access control policy](https://tailscale.com/security-policies/access-control), CC0._ Neither public sentence states a frequency. "Periodic" and "performed" prove that reviews exist, not how often. ## How GitLab answered **Yes**, in its CAIQ v4.0.3 submission on the [CSA STAR Registry](https://cloudsecurityalliance.org/star/registry/services/gitlab). GitLab's explanation for IAM-06 in the same file says it conducts quarterly access reviews; the public policy itself doesn't give the frequency. ## A good answer, if your policy supports it > **IAM-08.1: Yes.** Access to production and to systems holding customer data is reviewed quarterly; access to other business systems is reviewed annually. Each system owner confirms every account against current roles, removes access no longer needed and checks that no one holds conflicting roles. Reviews are recorded in \[tool\]. See Access Control Policy, "Access reviews". Write only the frequency your documents and records support. If you said quarterly last year and did one review, the honest answer is Partially. ## When N/A is honest Not for your own systems. If you have very few people and systems, a short annual review is still a review; describe it. ## Where answers usually go wrong * **A frequency nobody wrote down.** "Quarterly" is the most common invented detail in questionnaire answers, from people and from AI tools. It is easy to check: the buyer can ask for the last four review records. Our [ChatGPT guide](https://citesheet.com/guides/chatgpt-for-security-questionnaires/) explains why AI drafts tend to fill in exactly this kind of detail. * **Reviewing people, not permissions.** Confirming that everyone on the list still works here is half a review. The question asks about least privilege and separation of duties too: does each person still need _that level_ of access? ## Sources 1. [Cloud Security Alliance: Cloud Controls Matrix (CCM)](https://cloudsecurityalliance.org/ccm/) (accessed October 20, 2026) 2. [CSA STAR Registry: GitLab.com (CAIQ v4.0.3 submission, 2025-03-25)](https://cloudsecurityalliance.org/star/registry/services/gitlab) (accessed October 20, 2026) 3. [GitLab Handbook: Access Management Policy (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/security-and-technology-policies/access-management-policy/) (accessed October 20, 2026) 4. [GitLab Handbook: Records Retention & Disposal (CC BY-SA 4.0)](https://handbook.gitlab.com/handbook/security/policies%5Fand%5Fstandards/records-retention-deletion/) (accessed October 20, 2026) 5. [Tailscale security policies: Access control policy (CC0)](https://tailscale.com/security-policies/access-control) (accessed October 20, 2026) ## Related * [CAIQ IAM-05: Least privilegeCAIQ v4 control IAM-05 asks whether people and systems get only the access they need. What proves it, quoted examples from Tailscale, GitLab and PostHog, and gaps.](https://citesheet.com/caiq/iam-05-least-privilege/) * [CAIQ IAM-04: Separation of dutiesCAIQ v4 control IAM-04 asks whether no one person can both make and approve a risky change. What proves it in a small company, quoted examples, and honest answers.](https://citesheet.com/caiq/iam-04-separation-of-duties/) * [CAIQ IAM-03: Identity inventoryCAIQ v4 control IAM-03 asks whether you keep and review a record of who has which access. What proves it, quoted examples, and where policies fall short.](https://citesheet.com/caiq/iam-03-identity-inventory/) * [Can you use ChatGPT for security questionnaires?ChatGPT can draft security questionnaire answers, but it can invent controls, and uploaded policies follow different data rules by plan. How to use it more safely.](https://citesheet.com/guides/chatgpt-for-security-questionnaires/) ## Send one questionnaire. See the proof. First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps. Send your first questionnaire free Takes about 15 seconds. Or email [hello@citesheet.com](mailto:hello@citesheet.com). Need an NDA first? Ask, and we'll sign before you send anything.