Vendor access review overdue for third-party support vendors

CTRL-VRM-019/APRA CPS 230 Operational Risk Management and ISO 27001 Annex A.5.18 on access rights review.

Control statement

All third-party access to production systems, customer data, or operational support tooling must be recertified quarterly by the accountable service owner. Access without a completed recertification attestation must be suspended pending review.

What the evidence shows

The vendor access register shows last reviewed dates in September 2025 for four active vendor profiles. The recertification workflow export contains two missed review windows with status=overdue, and the support roster confirms those vendors still retain named accounts with VPN, ticketing, and privileged support entitlements.

Evidence artefacts

vendor-access-register-2026-q2.csv
recertification-workflow-export.json
third-party-support-roster-apr-2026.pdf

Affected assets

4 third-party vendor profiles and 19 active entitlements

PressRto run·1–5for stages

Remediation Memory

1 similar past remediation found

94%Similarity
CTRL-VRM-012·closed on 15 Dec 2025
Vendor access recertification sweep and escalation workflow
Ran a sweep across overdue vendor profiles, forced recertification by accountable service owners, suspended entitlements with no attestation, and introduced an automatic escalation workflow at day 7 of overdue status.
- Same control domain: Vendor Risk
- Same severity: Medium
- Control ID family: CTRL-VRM-
- Keyword overlap: vendor, access, recertification, review, third, party, attestation
52 min · closed by Nathaniel3 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.