ISO Access Review Campaigns

This is the help text the console shows in the help panel on this page.

Access Review Campaigns

This page manages periodic access review campaigns that support ISO 27001 A.5.18 (Access Rights) and A.8.2 (Privileged Access Rights). Each campaign collects manager-level approvals for current user access across your assets.

Campaign Lifecycle

1. Create: Click New Campaign and enter a campaign name, an optional review period and a due date.
2. Send to Managers: AutoCISO identifies the managers (from the manager assigned to each employee), shows you the list, and after you click Confirm & Send emails each manager a personal review link. If no managers are found, make sure employees have managers assigned and assets are configured.
3. In Progress: Managers open the emailed link (no AutoCISO login needed) and approve, revoke or escalate each access item. As the due date approaches, managers who have not finished get reminder emails.
4. Close: The campaign completes automatically when every manager has finished, or you can click Close Campaign earlier. Closing creates an evidence record in the Evidence Vault.

Campaign Cards

Each card shows the campaign name, review period, due date, status, how many managers have reviewed (“x/y managers reviewed”), and an Evidence created tag once evidence exists.

Evidence Generation

A closed campaign produces an evidence record titled “<campaign name> — Completed” with the number of managers, items, approvals, revocations and escalations. It is linked to controls A.5.18 and A.8.2 in the Evidence Vault.

Fields

Campaign Name

A descriptive name for this review cycle.

Examples: Q1 2025 Access Review, Annual Privileged Access Certification, Post-Acquisition Access Audit.

Review Period

The time period this campaign covers (e.g., Q1 2025, Full Year 2024). Used in reporting and audit documentation.

Due Date

The deadline by which all managers must complete their reviews. Reviewers receive reminder notifications as this date approaches.