User Access Review Worksheet for ERP and OT Accounts
Access reviews prove that the people with ERP, MES and plant network accounts still need them. This worksheet gives reviewers one list with stale login detection and a recorded decision, ready to hand to an auditor.
| Account | System | Role or group | Account type | Privileged | Days since last login | Stale (over 90 days) | Reviewer | Decision | |
|---|---|---|---|---|---|---|---|---|---|
0 | |||||||||
0 | |||||||||
0 | |||||||||
1 | |||||||||
1 |
Export an account list from each system, paste into the sheet, and have the business owner decide. Privileged, vendor and shared accounts deserve the closest look.
Automate quarterly ERP access extracts
Optional help pulling user, role and last login data from your ERP on a schedule.
Optional. The tool and every export work without this. No spam.
How to run a review
Export users from each system with role and last login date. Paste or type them into the sheet. Send each reviewer the rows they own and ask for a decision on every line. After decisions are made, IT executes the changes and records the date. Keep the exported file as evidence of the review.
- Review privileged accounts quarterly
- Review everyone else at least annually
- Disable before deleting
- Record who approved each decision
What the flags mean
The stale flag marks accounts unused for more than 90 days, a common threshold, though you can change the rule in your own copy. Stale privileged and vendor accounts are the highest risk because they are rarely noticed and often lack multifactor protection. Shared accounts break accountability, so each one needs a named owner and a plan to retire it, especially on HMIs where practical limits exist.
ERP and OT specifics
In ERPs also review segregation of duties, such as the same user creating vendors and paying invoices. In OT, review engineering workstation logins, remote access accounts and integrator credentials. Standards such as NIST SP 800-171 and IEC 62443 expect least privilege and periodic review.
Common mistakes
Letting IT approve its own users, accepting 'keep' with no thought, ignoring service accounts, and failing to follow through on removals. A review without executed changes has no value.
Frequently Asked Questions
How often should access be reviewed?
Privileged and vendor accounts quarterly, regular users at least annually, and any account on leaver or role change events. Regulated customers or frameworks may set the interval for you.
Who should decide keep or remove?
The business owner of the system or the person's manager, not the IT administrator. IT executes the change and records it. This separation is what auditors look for.
How do we treat shared shop floor accounts?
Inventory them, assign an owner, restrict their rights, and move to individual logins where the system supports it. Where it does not, add compensating controls like physical access and logging.
What about service accounts?
List each with an owner, purpose, and password rotation date. Remove interactive login rights and give the minimum privileges the integration needs.
If you want ERP role and last login data pulled automatically each quarter, we can help set that up. The worksheet stands alone.
Related Tools
Third-Party Remote Access Request Form Template
A request and approval form for machine builders, integrators and ERP consultants who need remote access to your systems.
Compliance & ContractsCyber Risk Register Worksheet for Manufacturers
Score IT and OT cyber risks by likelihood and impact, compare inherent and residual risk and track the treatment owner.
ERP OperationsBackup Restore Test Log Worksheet
Record each restore test, compare restore time to the target and see which systems miss their RTO.
Compliance & ContractsCyber Security Exception and Risk Acceptance Form Template
Record a policy exception for an unpatchable machine, legacy OS or vendor limitation, with compensating controls, expiry and executive acceptance.
More Compliance & Contracts tools
See all- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist
- EU Machinery Regulation 2023/1230 Readiness Checklist
Keep exploring
Free tools
- SyteLine Security and User Access Audit ChecklistA checklist for reviewing SyteLine users, authorizations, service accounts and integrations before an audit or after a staffing change.
- Infor XA (MAPICS) User Access Review WorksheetReview each user profile, last sign-on, role and conflicting duties, with a days inactive figure and review decision.
- OT Vendor Remote Access Hardening ChecklistA checklist of controls for machine builders, integrators and ERP partners who connect to your plant, grouped by identity, path, monitoring and lifecycle.
ERP fixes and how-tos
- How to Run an ERP User Access Review (Quarterly Checklist)How an IT manager runs an ERP user access review: pull the user and role list, get owner sign-off, test segregation of duties, and keep audit evidence.
- How to Add Users in the Baan / Infor LN GUI (Including Admin Access)Step by step: create a user in Baan or Infor LN with the User Data session, copy from a template, assign roles and authorizations, and what admin access you need.
- NetSuite Delete Integration: How to Remove an Integration Record and Its Token Access SafelyHow to delete or disable a NetSuite integration record and revoke its tokens safely: find what uses it, block it first, revoke access tokens, then remove it.
Guides
- ERP User Access Review Process GuideEstablish a structured ERP user access review process with review cycles, certification workflows, exception handling, and audit evidence for SOX and ISO compliance.
- How to Run ERP User Access Reviews That Pass AuditHow to run ERP user access reviews that pass audit: extract entitlements, choose reviewers, evidence decisions, and close revocations on a defensible timeline.
- SyteLine User Administration: Complete Management GuideManage user accounts in Infor SyteLine with profile creation, license assignment, role mapping, and session management. Complete admin guide for system administrators.