# User Access Review Worksheet for ERP and OT Accounts

> Source: https://netray.co/tools/user-access-review-worksheet-for-erp-and-ot-accounts
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

List accounts by system and role, flag stale or shared ones and record the keep, change or remove decision.

## Category

compliance-legal

## Audience

- IT security lead
- ERP administrator
- Internal auditor
- System owner

## Tool

**Kind:** worksheet

**Mode:** editable

**Columns:**

#### Account

**Key:** account

**Type:** text

#### System

**Key:** system

**Type:** select

**Options:**

- ERP
- MES
- SCADA / HMI
- Active Directory
- VPN
- Engineering workstation
- Cloud app

#### Role or group

**Key:** role

**Type:** text

#### Account type

**Key:** type

**Type:** select

**Options:**

- Named user
- Shared
- Service
- Vendor
- Break glass

#### Privileged

**Key:** priv

**Type:** select

**Options:**

- Yes
- No

#### Days since last login

**Key:** days

**Type:** number

#### Stale (over 90 days)

**Key:** stale

**Type:** number

**Expr:** if(gt(days, 90), 1, 0)

**Format:** integer

#### Reviewer

**Key:** owner

**Type:** text

#### Decision

**Key:** decision

**Type:** select

**Options:**

- Keep
- Reduce access
- Disable
- Remove
- Pending

**Rows:**

**Account:** jmorales

**System:** ERP

**Role:** Purchasing manager

**Type:** Named user

**Priv:** No

**Days:** 3

**Owner:** Procurement head

**Decision:** Keep

**Account:** svc_mes_sync

**System:** MES

**Role:** Integration service

**Type:** Service

**Priv:** Yes

**Days:** 0

**Owner:** IT security

**Decision:** Keep

**Account:** cell4_operator

**System:** SCADA / HMI

**Role:** Operator

**Type:** Shared

**Priv:** No

**Days:** 1

**Owner:** Production supervisor

**Decision:** Reduce access

**Account:** integrator_tm

**System:** VPN

**Role:** Vendor support

**Type:** Vendor

**Priv:** Yes

**Days:** 142

**Owner:** OT lead

**Decision:** Disable

**Account:** kwilliams

**System:** Active Directory

**Role:** Domain admin

**Type:** Named user

**Priv:** Yes

**Days:** 210

**Owner:** IT director

**Decision:** Pending

**Totals:**

#### Accounts reviewed

**Key:** account

**Agg:** count

#### Stale accounts

**Key:** stale

**Agg:** sum

**Format:** integer

#### Oldest login (days)

**Key:** days

**Agg:** max

**Format:** integer

**Summary:**

#### Share of accounts stale

**Key:** stale_pct

**Expr:** sum_stale / max(count, 1) * 100

**Format:** percent

**Notes:** Export an account list from each system, paste into the sheet, and have the business owner decide. Privileged, vendor and shared accounts deserve the closest look.

## Content

**Intro:** Access reviews prove that the people with ERP, MES and plant network accounts still need them. This worksheet gives reviewers one list with stale login detection and a recorded decision, ready to hand to an auditor.

**Sections:**

#### How to run a review

**Body:** Export users from each system with role and last login date. Paste or type them into the sheet. Send each reviewer the rows they own and ask for a decision on every line. After decisions are made, IT executes the changes and records the date. Keep the exported file as evidence of the review.

**Bullets:**

- Review privileged accounts quarterly
- Review everyone else at least annually
- Disable before deleting
- Record who approved each decision

#### What the flags mean

**Body:** The stale flag marks accounts unused for more than 90 days, a common threshold, though you can change the rule in your own copy. Stale privileged and vendor accounts are the highest risk because they are rarely noticed and often lack multifactor protection. Shared accounts break accountability, so each one needs a named owner and a plan to retire it, especially on HMIs where practical limits exist.

#### ERP and OT specifics

**Body:** In ERPs also review segregation of duties, such as the same user creating vendors and paying invoices. In OT, review engineering workstation logins, remote access accounts and integrator credentials. Standards such as NIST SP 800-171 and IEC 62443 expect least privilege and periodic review.

#### Common mistakes

**Body:** Letting IT approve its own users, accepting 'keep' with no thought, ignoring service accounts, and failing to follow through on removals. A review without executed changes has no value.

**Cta:** If you want ERP role and last login data pulled automatically each quarter, we can help set that up. The worksheet stands alone.

**Faq:**

#### How often should access be reviewed?

**Answer:** Privileged and vendor accounts quarterly, regular users at least annually, and any account on leaver or role change events. Regulated customers or frameworks may set the interval for you.

#### Who should decide keep or remove?

**Answer:** The business owner of the system or the person's manager, not the IT administrator. IT executes the change and records it. This separation is what auditors look for.

#### How do we treat shared shop floor accounts?

**Answer:** Inventory them, assign an owner, restrict their rights, and move to individual logins where the system supports it. Where it does not, add compensating controls like physical access and logging.

#### What about service accounts?

**Answer:** List each with an owner, purpose, and password rotation date. Remove interactive login rights and give the minimum privileges the integration needs.

## Search terms

user access review template excel, access recertification worksheet, ERP user access review, privileged account review template, stale account review worksheet, OT account review, quarterly access review form, shared account inventory

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json