How often should access reviews occur in FOSSE and what should they verify?

• A. Annually
• B. Monthly
• C. Never
• D. Regularly (quarterly or per policy); verify role assignments, revoke unused rights, ensure separation of duties, and confirm changes with business owners

Answer: (D)

Access reviews should be conducted regularly to keep permissions aligned with current roles and business needs. In FOSSE, the frequency is regular—quarterly or per policy—so privileges stay up to date as roles and personnel change. During these reviews, you verify that role assignments reflect what is actually authorized by the business owners, revoke any rights that are no longer needed, ensure separation of duties to prevent conflicts (for example, one person shouldn’t have both incompatible responsibilities), and confirm changes with the business owners responsible for those permissions. This approach helps maintain least privilege, reduce risk from excessive access, and ensure proper accountability. Annual reviews can miss drift; more frequent reviews are only necessary if policy requires them, and never reviewing access would leave security gaps.