People & access
Access reviews
Sync your directory, certify access with keep / revoke / modify, and record the whole review as audit evidence.
| System | Reviewer | Accounts | Flagged | Status |
|---|---|---|---|---|
| Production cloud | IT lead | 28 | 2 to remove | Complete |
| Source control | Eng lead | 19 | None | Complete |
| Finance system | Finance | 7 | 1 stale | In progress |
| Support desk | Support lead | 12 | None | Overdue |
Periodic access reviews are a real SOC 2 and ISO 27001 control, and the manual version (exporting a user list, emailing managers, chasing replies) is nobody’s favourite quarter. Keel syncs your directory, walks you through a keep / revoke / modify decision for each person, and records the whole thing as evidence.
The problem
Access reviews are a quarterly fire drill
Pull a user export, reconcile it by hand, ping managers over Slack, screenshot the replies, and hope you can reconstruct who decided what when the auditor asks. Every quarter, from scratch.
Capabilities
What Access reviews does
Directory sync
Pull your people from Microsoft Entra, Google Workspace, or a CSV, so a review starts from a current roster instead of a stale export.
Keep / revoke / modify
Certify each person’s access with a clear decision. The result is a defensible record of who reviewed what and what changed.
Recorded as evidence
A completed review is captured as audit evidence against the access-review control, exactly what SOC 2 and ISO 27001 assessors ask to see.
Recurring cadence
Run reviews on the cadence your framework expects (e.g. quarterly), so the control stays satisfied over time, not just once.
Outcomes
Why it matters
- Turn a multi-day fire drill into a guided workflow
- Start every review from a live directory, not a stale export
- Produce a defensible record of every access decision
- Satisfy a core SOC 2 / ISO 27001 control on a repeatable cadence
Get audit-ready, and prove it
Access reviews is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Frequently asked questions
Which directories can Keel sync?
Microsoft Entra, Google Workspace, or CSV import. Directory auto-sync is included on Pro, Enterprise and the MSP / Partner plan; CSV-based reviews are available on every plan.
Does a completed review count as evidence?
Yes. The review is recorded as audit evidence against the access-review control, with the decisions you made.
Can I run access reviews on a schedule?
Yes. Run them on the cadence your framework expects so the control stays continuously satisfied.
Related features: Evidence management · Security awareness training · Controls & crosswalk
Works with: SOC 2 · ISO/IEC 27001