Why it matters
Access that's never reviewed accumulates — ex-contractors and old roles quietly keep permissions nobody remembers granting.
How a self-led small team implements it
A quarterly access review, even a manual one, is legitimate evidence at small scale.
What auditors expect to see
Access review log, granting/revocation records.
Track A.5.18 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS