CAIQ IAM-08: User access review

What the control asks

IAM-08.1: Are reviews and revalidation of user access, for least privilege and separation of duties, completed with a frequency commensurate with organizational risk tolerance?

In plain English: does someone regularly go through the list of who has access, confirm each person still needs it, and remove what they don't? The CAIQ leaves the frequency to you ("commensurate with risk"), but it expects you to have one.

Which policy usually proves it

The Access Control Policy, in an access review section. The best answers point to three things: the rule (reviews happen), the frequency (how often, for which systems) and the record (where the completed reviews are kept).

Quoted evidence from public policies

GitLab states the rule:

Access reviews are performed to confirm existing access.

GitLab Handbook, Access Management Policy, CC BY-SA 4.0.

GitLab's Records Retention & Disposal also lists "System access reviews" as a record kept for 1 year 3 months, which is indirect evidence that the reviews produce a record.

Tailscale ties the review to the movers problem from IAM-07:

Since there could be delays in reporting changes in user responsibilities, periodic user access reviews are conducted by the Security Review Team.

Tailscale, Access control policy, CC0.

Neither public sentence states a frequency. "Periodic" and "performed" prove that reviews exist, not how often.

How GitLab answered

Yes, in its CAIQ v4.0.3 submission on the CSA STAR Registry. GitLab's explanation for IAM-06 in the same file says it conducts quarterly access reviews; the public policy itself doesn't give the frequency.

A good answer, if your policy supports it

IAM-08.1: Yes. Access to production and to systems holding customer data is reviewed quarterly; access to other business systems is reviewed annually. Each system owner confirms every account against current roles, removes access no longer needed and checks that no one holds conflicting roles. Reviews are recorded in [tool]. See Access Control Policy, "Access reviews".

Write only the frequency your documents and records support. If you said quarterly last year and did one review, the honest answer is Partially.

When N/A is honest

Not for your own systems. If you have very few people and systems, a short annual review is still a review; describe it.

Where answers usually go wrong

• A frequency nobody wrote down. "Quarterly" is the most common invented detail in questionnaire answers, from people and from AI tools. It is easy to check: the buyer can ask for the last four review records. Our ChatGPT guide explains why AI drafts tend to fill in exactly this kind of detail.
• Reviewing people, not permissions. Confirming that everyone on the list still works here is half a review. The question asks about least privilege and separation of duties too: does each person still need that level of access?