Test · TST-Q2-ACC-03
ACC-03 · Privileged access is just-in-time and reviewed
FailQ2 2026 Unified Program ReviewTested 18 Jun 2026 by Farah Khan, Vikram Mehta · Meridian Internal Audit
Requirement to validation
Requirement
ISO-A.8.2 · ITGC-AM-02 · RBI-CSF-NBFC-Annex-1-2 · RBI-ITGRCA-2023-7.1 · SOC2-CC6.1 · SOC2-CC6.3
mapped
Policy
Access Control Policy
pol-access
Control
ACC-03
Privileged access is just-in-time and reviewed
Application
Amazon Web Services (ap-south-1) · Microsoft Entra ID · SAP S/4HANA
mapped
Evidence · Q3
7 items
3 approved · 4 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-ACC-03 · Medium confidence
Finding
F-ITGC-02 · Medium
In Progress
Action
Rahul Nair
REM-F-ITGC-02 · In Progress
Validation
Pending
as recorded
Procedure and result
- Procedure
- Entra PIM, AWS IAM Identity Center temporary elevation (TEAM), SAP GRC firefighter. Tests: Microsoft Entra ID: No permanent Global Administrator assignments; Amazon Web Services (ap-south-1): No standing AdministratorAccess permission sets; SAP S/4HANA: Firefighter sessions reviewed. Frequency continuous.
- Sample
- 25 items sampled (Q2 baseline)
- Expected
- Administrative access to AWS, Azure, Entra ID and SAP is granted just-in-time through PIM / firefighter IDs with approval, MFA and session logging; no standing admin access exists outside break-glass accounts.
- Observed
- Two Entra Global Administrators and two AWS AdministratorAccess assignments were permanent rather than just-in-time.
- Confidence
- High