Run a Quarterly Access Review for the Executive Office Suite

Access grows quietly in the executive suite

Access in an executive office rarely changes in one dramatic decision. A temporary badge stays active after a project ends, a calendar delegate is added during a vacation and never removed, and a shared folder keeps a former contractor's permissions for months. Each change is small and reasonable at the time. Together they create a wide surface that nobody can describe from memory.

A quarterly access review is a structured way to catch that drift. It is not a security audit and does not require a dedicated security team. It is a recurring maintenance task that the assistant can run with support from IT, facilities, and the executive. The goal is a current list of who can reach what, why they need it, and when the access should end.

Build one inventory before changing anything

Start by listing the access paths that matter in the executive office. Include building badges, visitor passes, parking or floor access, calendar delegates, shared mailboxes, file shares, cloud folders, e-signature accounts, travel booking profiles, and any vendor portals that contain executive information. The list does not need to be exhaustive in the first pass. It needs to be concrete enough that someone can check each item.

For each path, record the owner, the people with access, the date access was granted, and the business reason. If the reason is unknown, mark it as unknown rather than inventing one. The review will be more useful if it surfaces uncertainty honestly. The access control lessons from NIST provide a useful frame for thinking about least privilege without turning the exercise into a technical audit.

Review badge and building access

Building access is often the least documented and most visible form of access. Ask facilities for a current badge list and compare it with the office roster. Look for badges assigned to people who have left, contractors whose engagements ended, and vendors who needed one-time entry. Check whether temporary badges have an expiry date and whether that date is enforced.

Walk the suite with the list in hand. Confirm that restricted areas actually require the badge level the list claims. A storage room with a badge reader that has been propped open is not restricted in practice. Note any shared codes, unlabeled keys, or reception drawers that contain spare badges. The review should produce a short list of fixes, not a general warning about security.

Review calendar delegates and shared mailboxes

Calendar delegates can see meeting details, send invitations, and change the executive's schedule. Shared mailboxes can contain sensitive correspondence and account recovery messages. Both deserve the same scrutiny as a building badge. Compare the delegate list with the people who currently support the executive and remove anyone who no longer needs the ability to edit. Then check whether the delegate still has the same role that justified the access.

Check the permission level as well as the name. Someone who only needs to view a calendar should not have edit rights. Someone who needs to manage a single shared mailbox should not have full access to every mailbox in the office. Record the reason for each exception and the date it should be reviewed. The vendor call log can serve as a model for recording who has access and why.

Review file shares and cloud folders

File shares tend to accumulate nested permissions that nobody remembers setting. Ask IT for a report of the executive office's folders and the people or groups with access. Look for folders shared with "anyone with the link," outside collaborators with edit rights, and former employees whose accounts remain active. Check whether sensitive folders inherit permissions from a broader parent folder.

The review should distinguish between read access and edit access. A colleague who needs to reference a board pack does not need the ability to change it. A vendor who needs to upload a document should have a narrow upload path rather than access to the whole folder. Where possible, replace individual permissions with a named group that the office can review once. NIST's Cybersecurity Framework describes this kind of identity and access discipline as part of a broader governance practice.

Review vendor and contractor access

Vendors often receive access that outlives the work. A travel coordinator may still hold a booking profile after the contract ends, and a technology vendor may still have a support account that can reach executive files. List every vendor with access, the account or badge they use, the person who sponsors them, and the end date. Confirm that the sponsor still works with the vendor and that the access is still necessary.

For each vendor, decide whether the access should be removed, reduced, or renewed with a new end date. Put the decision in writing and send it to the vendor's account manager. Do not rely on a verbal promise that an account will be closed. The review should end with a dated confirmation from the vendor or from IT that the change was made.

Use a simple evidence standard

A name on a list is not proof that access is correct. Ask for a screenshot, an export, or a system report that shows the current permission. File the evidence with the review record. If a system cannot produce a report, note that limitation and ask IT to add one before the next review. The absence of evidence is itself a finding.

Keep the evidence in a restricted location and retain it according to the office's records policy. The records retention baseline can help the team decide how long to keep the review records. Do not store passwords, badge numbers, or full account identifiers in the same document as the access list. The review needs enough detail to verify the change, not enough to create a new exposure.

Close the loop and set the next review

End each review with a short action list. Name the person responsible for each removal or reduction, the date it should be completed, and the evidence that will close the item. Follow up on the list at the next team meeting rather than waiting for the next quarterly cycle. An access review that produces no completed changes is just a document.

Schedule the next review before the current one closes. Put it on the executive office calendar and assign a backup owner so the task survives vacation and turnover. For help building repeatable access routines that fit an assistant's workload, talk to our team. The best review is short enough to repeat and specific enough to change something, and a standing calendar entry is what keeps it from disappearing.