164.308(a)(4)(ii)(C) Access Establishment and Modification (Addressable)
Administrative safeguard · Addressable
The requirement as we hold it
Access Establishment and Modification (Addressable). Implement policies that document, review, and modify a user's right of access. NIST recommends periodic recertification and just-in-time elevation for privileged tasks.
The examiner asks
- Show me how you document, review and modify a user's right of access over time.
- When was the last recertification, and what did it find?
Evidence to bring
- the access-review records
- the recertification result
Source: 164.308(a)(4)(ii)(C) at eCFR. Our statement of the clause, not the instrument verbatim.