A free user access review template you can fill in today
One sheet per system, one row per account, and a header that proves nothing was left out. Download it free and run your first review this week.
This user access review template is free to copy. It fits one system per sheet. A header says where the account list came from and how many rows it had. Below it, each account gets a decision (keep, reduce or remove), a reason, and the ticket that made the change.
You need the workbook, one export, and about an afternoon. It downloads as Excel with a sign-off sheet, and the full layout is printed below. No tool, no consultant, no email gate.
What this costs to run yourself
Almost nothing in money. The real cost is attention: someone has to pull the export, sit with a reviewer, and chase the removals to the end. That is an afternoon per system each cycle for a team of ten. The expensive version is the review that never happened. An examiner samples it, finds a gap, and the gap prints in the report your buyer reads.
So spend your effort on the three things that make a review count: a complete account list, a reviewer who is not the grantor, and a written decision on every row. The layout below is built around those three.
Part one: the header
Fill these six fields before touching a single row. They answer the first question any reader asks, which is whether the list in front of the reviewer was the whole list.
| Field | What to write |
|---|---|
| System reviewed | One application or environment, named as your inventory names it |
| Review period | Start and end dates. Coverage is decided by date |
| Population source | The report that produced the list, the tool, the timestamp |
| Row count | Accounts the export returned, so none fall out unnoticed |
| Reviewer | The person deciding, by name and role. Not a team |
| Completed and approved | When the last row was decided, and who accepted it |
Part two: one row per account
Eleven columns. The right hand column tells you what a bad entry looks like, because a cell can be full and still useless. Check each row against it before you sign.
| Column | Fill it with | A bad entry |
|---|---|---|
| Account identifier | One row, one identity, as the export writes it | A display name. Two people called Chris Martin merge |
| Person and status | Employee, contractor, terminated, or service account | A blank. Status decides which rule applies |
| Access held | The role as the system names it, say AdministratorAccess | A paraphrase like normal access. Nothing gets decided |
| Privileged | Yes or no, by the definition in your policy | Every row no. Then the definition is wrong |
| Granted on, granted by | When the access was given, and who approved | An empty cell. Unknown is a value; blank is not |
| Business justification | The work this access exists to do | Needs access. A reason fitting everyone justifies no one |
| Decision | Keep, reduce or remove. One per row | A checkmark. It records attention, not a decision |
| Reason | Why, for every reduce, remove and privileged keep | Blank on a removal. The next reviewer inherits nothing |
| Action ticket | The ticket that carries out the decision | The word done. A status references nothing |
| Completed on | The date the change landed in the system | The day you closed the ticket, not the day access went |
| Verified by | Who confirmed the change, and the record read | The reviewer name again, where policy wanted two people |
A sample row, filled in
Here is one account as it would sit in the sheet. The contractor finished in spring. The admin role did not go with them, because offboarding closed the identity account and missed a group in the cloud console.
| Column | Entry |
|---|---|
| Header | aws-prod-payments, 2026-04-01 to 2026-06-30. IAM credential report exported 2026-07-08 09:14 UTC, 41 rows. Reviewer Priya Raman, VP Engineering |
| Account identifier | dana.okafor@acme.io |
| Person and status | Dana Okafor, contractor, terminated 2026-05-02 |
| Access held | AdministratorAccess, via the sso-engineering group |
| Privileged | Yes |
| Granted on, granted by | 2025-11-14, approved by Sam Ortiz, head of platform, in TICKET-2291 |
| Business justification | Payments migration, statement of work closed 2026-05-02 |
| Decision | Remove |
| Reason | Access survived offboarding by 67 days. Offboarding covered the identity provider, not the group |
| Action ticket | SEC-412, opened 2026-07-08 |
| Completed on | 2026-07-08, group membership removed 16:12 UTC |
| Verified by | Marcus Lee, from the RemoveUserFromGroup event in the audit log |
Keep this row. Quietly fixing the account and filing a clean sheet throws away proof that the control works. A year of reviews that never remove anyone looks less believable, not more.
Four rules the record has to follow
The template is the easy part. These rules decide whether the finished sheet holds up when somebody outside the company reads it a year from now.
- The list comes out of the system
- Run a named report and save it untouched next to the sheet. If the export has 41 rows and the sheet has 38, those three are what the review is for. The evidence request list asks for whole populations in the same way.
- Someone else decides
- An admin checking their own grants repeats a judgment already made.1 On a team of five that someone may be a founder, which is fine if the two names differ. SOC 2 on a small team covers the other places headcount forces that swap.
- Every row gets words
- A blank means it was not reviewed. A quarter with no changes is still written up: state the row count and that every account was kept.
- Odd accounts get extra fields
- A leaver found in the export gets their end date, the removal date and the gap in days. A service account gets a human owner, a last rotated date and a last used date. A shared login lists every holder and says whether the system can tell them apart.
What to keep once it is signed
Five files, created in this order and left alone afterwards. A sheet edited months after sign off raises a question the file itself cannot answer, so lock it or export a copy.
- The raw export, with the tool and run time visible.
- The finished sheet, every row decided, reviewer named, dated.
- A ticket for every change, cited by ID from its row.
- A log entry for every change, showing the access went.
- A dated approval, given after the last row was decided.
Where it maps in SOC 2
The review answers the logical access criteria.1 CC6.1 is about protecting the system with access controls. CC6.2 covers registering users before they get credentials and removing them when access stops being right. CC6.3 covers role based grants, changes and removals with least privilege in mind. Your auditor sets the exact mapping, and your own policy sets the pace you are tested on.2 How many policies you need explains how a copied promise turns into an exception, and five common control failures shows where access sits among them.
Two other free templates sit on either side of this one. The access control policy template sets the pace at every six months, and every quarter for production and privileged roles. The offboarding checklist removes leavers before this review has to find them.
Keep it free, or let the software carry it
The template stays free, and running it by hand is a real option. If you would rather not chase exports every quarter, cybersoftware takes this record as evidence against the access control criteria and files it, with its dates, in the package your independent partner auditor reviews. Scope is Security only. You start with onboarding at $2,000 one time, or with $4,000 one time, which adds the SOC 2 Type 1 examination and report with the auditor fee included. Type 2 is then $600 a month on a 12-month term, and your first SOC 2 Type 2 audit is included in the term. It starts once the 3-month observation window completes.
Start with the free readiness assessment to see where access sits among your other gaps, or see every price on pricing.
cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.
Questions
What is a user access review?
What should the template contain?
Who is allowed to review access?
Is quarterly required, or can the review be annual?
Do I need software to run access reviews?
Sources
Get audit-ready without a compliance team
The readiness assessment is free, with no payment and no card. Onboarding is $2,000 one time, then SOC 2 Type 2 is $600 a month on a 12-month term, and your first SOC 2 Type 2 audit is included in the term. You can be audit-ready starting at about a week.
Start with a free readiness assessmentcybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.