Compliance & ContractsFree worksheetPDF, Excel, Word export

User Access Review Worksheet for ERP and OT Accounts

Access reviews prove that the people with ERP, MES and plant network accounts still need them. This worksheet gives reviewers one list with stale login detection and a recorded decision, ready to hand to an auditor.

Download:

Account	System	Role or group	Account type	Privileged	Days since last login	Stale (over 90 days)	Reviewer	Decision
						0
						0
						0
						1
						1

Accounts reviewed

Stale accounts

Oldest login (days)

210

Share of accounts stale

40%

Export an account list from each system, paste into the sheet, and have the business owner decide. Privileged, vendor and shared accounts deserve the closest look.

Automate quarterly ERP access extracts

Optional help pulling user, role and last login data from your ERP on a schedule.

Optional. The tool and every export work without this. No spam.

How to run a review

Export users from each system with role and last login date. Paste or type them into the sheet. Send each reviewer the rows they own and ask for a decision on every line. After decisions are made, IT executes the changes and records the date. Keep the exported file as evidence of the review.

Review privileged accounts quarterly
Review everyone else at least annually
Disable before deleting
Record who approved each decision

What the flags mean

The stale flag marks accounts unused for more than 90 days, a common threshold, though you can change the rule in your own copy. Stale privileged and vendor accounts are the highest risk because they are rarely noticed and often lack multifactor protection. Shared accounts break accountability, so each one needs a named owner and a plan to retire it, especially on HMIs where practical limits exist.

ERP and OT specifics

In ERPs also review segregation of duties, such as the same user creating vendors and paying invoices. In OT, review engineering workstation logins, remote access accounts and integrator credentials. Standards such as NIST SP 800-171 and IEC 62443 expect least privilege and periodic review.

Common mistakes

Letting IT approve its own users, accepting 'keep' with no thought, ignoring service accounts, and failing to follow through on removals. A review without executed changes has no value.

Frequently Asked Questions

How often should access be reviewed?

Privileged and vendor accounts quarterly, regular users at least annually, and any account on leaver or role change events. Regulated customers or frameworks may set the interval for you.

Who should decide keep or remove?

The business owner of the system or the person's manager, not the IT administrator. IT executes the change and records it. This separation is what auditors look for.

How do we treat shared shop floor accounts?

Inventory them, assign an owner, restrict their rights, and move to individual logins where the system supports it. Where it does not, add compensating controls like physical access and logging.

What about service accounts?

List each with an owner, purpose, and password rotation date. Remove interactive login rights and give the minimum privileges the integration needs.

If you want ERP role and last login data pulled automatically each quarter, we can help set that up. The worksheet stands alone.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools