Four linked tabs, with drop-down lists and a colour alert when a review is overdue.
Tab 1 Access log Your permissions matrix: every account, its role, its creation date, and its manager.
Tab 2 Application inventory Your SaaS apps, with their owner, criticality and review frequency.
Tab 3 Joiners and leavers The checklist of access to grant or revoke for employees and contractors.
Tab 4 Access reviews The review calendar and the decision recorded for each access.
The columns in the access register
The access register is the heart of the template. Each row represents one account in one application, so you can answer who has access to what and who approved it.
Column
Purpose
Example
User
The name and email of the account holder.
Camille Laurent
Type
Employee, contractor, intern or service account.
Contractor
Application
The tool concerned.
Slack
Role / permissions
The access level granted.
Admin
Owner
The person who approves access for the business.
Marketing director
Start date
When access was granted.
12/03/2026
Next review
Calculated from the review frequency set for the application.
12/09/2026
Decision
The outcome of the latest review.
Keep / Change / Remove
Status
A colour-coded alert.
Review overdue
METHOD
How to run an access review with this workbook
An access review checks whether each person still needs their permissions. The first one takes a few hours with the template; later reviews take much less time.
1
List your applications — Start with the most sensitive ones: email, storage, CRM, accounting, and administrative tools.
2
Export accounts from each tool — Paste the user list exported from each SaaS console into the registry.
3
Assign each account to a person — Link each access to a user, a role, and a manager. Prioritize unknown accounts.
4
Get approval from managers — For each access, record the decision: keep, modify, or remove, along with the date.
5
Apply and schedule the next one — Remove denied access, then schedule the next review date.
How often should you review access?
There is no single review frequency: it depends on the sensitivity of each access right. Adapt these common benchmarks to your security policy.
3 months Administrator accounts Review the broadest permissions most often.
12 months Other applications Collaboration tools and everyday use.
End of assignment Contractors At each departure, in addition to scheduled reviews.
Access reviews, ISO 27001 and NIS2
Both frameworks require access rights to be controlled over time. The workbook helps you document that process.
ISO/IEC 27001:2022 — Control 5.18 “Access rights”
Access rights should be granted, reviewed at regular intervals, and changed or removed when no longer justified.
NIS2 Directive — Access control policies
The expected risk management measures for covered entities include access control and asset management policies.
When a spreadsheet is no longer enough
An Excel workbook is a good starting point, but it relies on manual updates. One missed departure or a new app added by a team can leave it out of date. MIA syncs accounts directly from your applications and records every decision.
Excel template
MIA
Account inventory
Manual entry
Synced
Unknown accounts
Invisible
Detected
Review reminders
Manual tracking
Automated
Decision history
Editable
Timestamped audit trail
Get the Excel template by email
Free, no account required, and compatible with Google Sheets. After your request, our team will email you the link.
Thanks! We received your request. Our team will email you the Excel template link.
We couldn’t send your request. Please try again.
Frequently asked questions
What is an access review?
What is an access rights matrix?
Is the Excel template free?
Does it work with Google Sheets?
Is a spreadsheet enough for an ISO 27001 or NIS2 audit?
