What are user access reviews?
User access reviews (also called access certifications) are formal checks of who has access to which systems and whether that access is still appropriate for their role. They’re required by SOC 2, ISO 27001, PCI DSS, and NIST, and they catch overprovisioned, orphaned, and inappropriate access before it becomes a breach.
How does Compyl automate user access reviews?
Compyl pulls access from your identity providers, Okta, Microsoft Entra, Google Directory, JumpCloud, schedules recurring or ad hoc campaigns, routes each entitlement to the right reviewer for a one-click approve or revoke, and auto-creates remediation tasks for anything declined. Every outcome maps to the controls it satisfies.
How is Compyl different from a spreadsheet or standalone IGA tool?
A spreadsheet is stale the day it’s filled in, and a standalone identity tool is disconnected from your compliance program. Compyl runs reviews inside your GRC platform, so every certification outcome becomes audit-ready evidence, who had access, when it was reviewed, and what action was taken.
Can Compyl schedule recurring access reviews?
Yes. Compyl runs scheduled recurring campaigns, quarterly, semi-annual, or annual, plus ad hoc reviews triggered by role changes or system risk level, with automatic reviewer assignment, due dates, reminders, and a live dashboard of what’s planned, in progress, and complete.
How does Compyl handle remediation?
When a reviewer declines access, Compyl automatically creates and assigns a revocation or change task to the right team, tracks it to closure, and records the outcome, so overprovisioned and orphaned access is closed fast, with a documented trail.
Which frameworks do user access reviews support?
Access reviews are required by SOC 2 (CC6.x), ISO 27001 (A.5.18), PCI DSS v4.0.1 (Req 7), NIST CSF and NIST 800-53 (AC family), and more. Compyl maps each review to the controls it satisfies, so a single campaign produces evidence across every framework it touches.
Does SOX require user access reviews?
SOX ITGC testing commonly expects periodic access reviews of financial systems. Compyl can schedule reviews for finance systems alongside SOC 2, ISO 27001, PCI DSS and NIST access-control reviews, and files each completed campaign as evidence.
How are revocations proven to auditors?
Every revoke decision becomes a tracked remediation task, and the completed campaign is mapped to the controls it satisfies, so the auditor sees who reviewed what, what was revoked and when it closed.
