IT, data & continuous
User Access Review (UAR)
A periodic audit process where user access rights on information systems are verified and certified by business managers (resource owners) as appropriate for the current role. UAR ensures compliance with the principle of least privilege and is an important control against unauthorised access. Review frequency varies by sensitivity (for example more often for privileged accounts; PCI DSS requires at least semi-annually).
Source: IIA GIAS 2024, PCI DSS v4.0
Last updated: