Access Reviews

Access Reviews

Access reviews verify that all user accounts, roles, and permissions are still appropriate. They are required for SOC 2 CC6 and are included in every evidence pack.

Requires: Enterprise license, NSELF_COMPLIANCE_SOC2=true

Recommended cadence

• Quarterly minimum (CC6 requirement)
• After significant personnel changes
• After any security incident

API

Create a review

POST /api/v1/compliance/access-reviews

{
  "period_start": "2026-01-01",
  "period_end": "2026-03-31",
  "reviewer_id": "<user-uuid>"
}

List reviews

GET /api/v1/compliance/access-reviews

Complete a review

PATCH /api/v1/compliance/access-reviews/:id

{
  "status": "complete",
  "findings": {
    "accounts_reviewed": 42,
    "access_removed": 3,
    "roles_changed": 1
  }
}

Status values: pending complete overdue

Evidence export

Access reviews are exported as CC6-access-review.csv in the SOC 2 evidence pack. Only reviews whose period_end falls within the requested date range are included.

See SOC 2 Readiness for pack generation instructions.