User access reviews for utilities, done every quarter, with every revocation proven in the system it was removed from
Quarterly access reviews done and proven.
See one case, screen by screen ↓A user access review is the check that everyone who can log on to a grid control system, or walk unescorted into a control room, still needs that access and is authorized for it. NERC CIP-004-7 asks every calendar quarter that each person with electronic or unescorted physical access has an authorization record (R4.2), every 15 months that accounts, groups and privileges are correct and necessary (R4.3), and that a leaver's badge and Interactive Remote Access go within 24 hours (R5.1). Today the proof is stitched together by hand: an HR export, a badge-system export and account lists from the EMS, the remote access gateway, the historian, substation engineering access and water SCADA, matched by name in spreadsheets that share no key.
The system owner then gets a row that says “dokoro_adm · EMS-SysAdmin”. It does not say the account was last used 147 days ago, or that its holder moved to Asset Planning in June. Without that, keep is the safe click. Movers are the gap: a leaver comes through a clear HR event, a transfer often triggers no removal at all. And a revocation is asserted, not proven — the ticket says done, while CIP-004's measures ask for “logs or other demonstration showing such persons no longer have access”.
Estimated from the demo utility's last spreadsheet cycle, about 6 days a quarter for 412 rights across 6 systems; to be measured in the pilot.
Seven specialist agents gather the evidence, build each owner's deck and prove every removal; system owners decide and the CIP Senior Manager signs.
Lumina Utilities opened its Q4 2026 quarterly access review on 1 Oct: 412 rights held by 138 people and 3 service or pool accounts, across 6 systems, due 31 Dec. It is Tuesday 13 Oct, day 13 of 92. Here is what happens next, screen by screen, in the working solution.
Overnight the agents read the accounts, groups and badge zones of all 6 systems, read-only, and joined each one to HR by employee number, email and badge number. 298 of 412 rights are already decided (72 %). 41 are flagged for a person's judgement — 19 unused 90+ days, 9 where the role does not fit, 6 movers or leavers, 4 with training or a risk assessment lapsing, 3 with no authorization record — and 15 of those are still open.
“Agents flag; owners decide. A flagged right kept needs a reason.”
Tobias owns the Harrowgate EMS and its 96 access rights; 82 are decided and his deck holds the 14 left. The top card is Daniel Okoro's dokoro_adm, EMS System Administrator, privileged. Last used 19 May 2026 — 147 days ago, with no logon in the last 90. Role fit: 0 of 14 people in Asset Planning hold this role; usually EMS support engineers do (6 of 6).
Agents suggest Revoke — “Not needed in his current role. He moved jobs in June, has not used it in 147 days, and nobody in Asset Planning holds it.” · 4 of 5 checks point to revoke · you decide
The account reader took the EMS directory export at 06:02: 96 accounts, dokoro_adm enabled, member of EMS-SysAdmin. The HR feed matcher matched employee E-20417 to mover event MV-2026-0611: SCADA Engineering to Asset Planning on 3 Jun 2026. The authorization checker found AR-2023-0412, granted for his SCADA engineering job; training current to 2 Feb 2027; risk assessment Aug 2021, valid to Aug 2028.
“Review deck builder · suggests revoke · 4 of 5 checks point to revoke · the decision is yours”
Tobias presses Revoke — the button, the R key, or a drag of the card to the left. He picks the reason, “Not needed in current role”, and confirms. Had he kept a flagged right, he would have needed a reason too, and it would go into the evidence pack with his name.
“The removal agent disables dokoro_adm in the EMS directory, then re-reads it and files the proof.”
Change sent to the EMS directory at 09:42:11. Disabled and removed from EMS-SysAdmin at 09:42:40. At 09:43:05 the removal agent re-reads the EMS directory: status enabled → disabled, groups EMS-SysAdmin → none, fingerprint 9f3c…a71e. The counter reads 17 of 18 revocations proven in the target system, and the deck moves on to Grace Whitlow, where the evidence supports keeping.
“Moved jobs on 3 Jun with no removal: sent to Helena Marsh to assess against CIP-004 R5.2.”
Receipt RV-2026-0418 sits in Proofs with the person, the system, the account, why, who decided, when it was proven and the before and after read from the EMS directory. This quarter: 18 revoked, 17 proven in the target system, 54 s median from decision to proof, and 8 of 8 leaver removals proven inside 24 hours. The one waiting is a contractor pool card at the Brackenmoor gate, whose controller is offline.
“Receipts are permanent and fingerprinted · Re-read within 2 minutes · retry every 15 minutes · alarm after 2 hours”
Daniel's page joins every right he holds by employee number, email and badge. His remote access was revoked by Priti Valdés on 9 Oct and proven in 48 s. His historian reader role is kept — 11 of 14 Asset Planning peers hold it. His Control room · Zone 1 badge is still open: 1 of 14 peers hold it, and it belongs to Ines Varga, so the page offers “Ask Ines Varga to revoke”.
“In his new job, 2 of his 4 rights are held by almost none of his peers.”
The hourly HR feed starts the clock each event needs. Hannah Leclerc, shift engineer, left at 08:00 this morning: her badge was proven gone at 08:21, her remote access at 08:24 and her EMS account at 08:30. Rui Matos, a Kestrel Field Services contractor, was proven out in 1 h 14 min. Bram de Wit's relay engineering access is kept for handover to 16 Oct by Kwame Asante's decision. This quarter, 9 of 9 inside the clock.
“Shared password ‘ems_shiftlead’ (shift-lead console) she knew: change due by 12 Nov 2026 (R5.4) — scheduled 14 Oct”
Last night's match of HR, badge and account lists found what no single list shows. G-031, the late removal: Daniel Okoro, now revoked and proven, with Helena for CIP-004 R5.2. G-030, svc_ems_backup: administrator rights, no HR match, no named owner, and it runs the nightly backup. G-029: Tom Brierley's administrator role, granted by change CHG-118204 without an authorization record — keeping it needs a second approver.
“Pool card active on the Brackenmoor gate with no person assigned. Revoked 12 Oct; re-read waiting, gate controller offline.”
The evidence pack writer builds the pack by requirement from owner decisions, receipts and HR events: R4.2 at 73 %, R5.1 at 100 % with the slowest leaver removal at 1 h 14 min, R5.4 at 50 % with one shared password due 12 Nov, training and risk assessments at 137 of 138 people current. The pack is fingerprinted 6b0e…d2a4. Helena Marsh checks it; Owen Castellano, the CIP Senior Manager, signs.
“Every line in the pack links to the decision or receipt behind it. Nothing in a signed pack can be edited.”
The same quarter's review, seen by the four people who run it, decide it, check it and sign it — what their quarter looked like, and what it looks like now.
Seven specialist agents gather the evidence, build each owner's deck and prove every removal; system owners decide and the CIP Senior Manager signs.
Reads the hourly leaver and mover feed and joins each person across HR, badge and account lists by employee number, email and badge number. Starts the 24-hour, next-day and 30-day clocks.
Pulls account, group and badge-zone lists from the six systems every night, with each system's logon history, and fingerprints each export.
Works out last use and the daily usage strip for each right, and its fit against the person's current peers — how many hold the same role, and who the usual holders are.
Matches each right to the authorization record that granted it and the job it was granted for, and checks training (every 15 months) and the personnel risk assessment (every 7 years).
Builds each owner's deck: one card per right, the evidence on it with its source, and a suggestion — keep, revoke, ask the manager or assign an owner — with the reason in one sentence.
After an owner revokes, sends the change through the system's provisioning connection, re-reads the target system within 2 minutes and writes the proof receipt with before and after, the read time and a fingerprint.
Builds the dated quarterly evidence pack for CIP-004 R2.3, R3, R4.2, R4.3 and R5.1–R5.4: what was verified, by whom and when, every line linked to its decision or receipt, then fingerprints it and sends it for signature.
Decides every right; the CIP Senior Manager signs. The agents propose; a named person decides.
Ask about any person, right or revocation in the quarter's review — or say what to change. Every answer points to its records.
Why should I revoke Daniel Okoro's admin account?
Three things on his card point the same way. He moved from SCADA Engineering to Asset Planning on 3 Jun 2026 and no access review was requested. dokoro_adm was last used on 19 May 2026, 147 days ago, with no logon in 90 days. 0 of 14 people in Asset Planning hold EMS System Administrator; all 6 holders are EMS support engineers, and it was granted for his old job. If you revoke it, it is disabled in the EMS directory and re-read to prove it.
Which rights have not been used in 90 days?
19 rights this quarter have no logon in 90 days or more. 3 are in your deck: Daniel Okoro (147 days), the Halvorsen vendor account vnd_halvorsen01 (211 days) and Mei Takahashi (96 days, on the ADMS project). The oldest is hist_import2 on the historian, unused for 380 days.
Were all leavers removed inside the 24-hour clock?
Yes. 4 of 4 leavers this quarter had their badge and remote access removed and proven inside 24 hours (CIP-004 R5.1). Hannah Leclerc this morning took 24 minutes; the slowest was Rui Matos at 1 h 14 min. One follow-up is open: the shared shift-lead console password she knew is due by 12 Nov (R5.4).
Build the Q4 evidence pack for Helena
Building an interim pack now from owner decisions, receipts and HR events, by requirement: R4.2, R4.3, R5.1 to R5.4, R2.3 and R3. Every line links to its decision or receipt. Helena Marsh checks it; Owen Castellano signs.
13 screens from the working solution, on its sample data. Pick one to see it large.
What the utility configures for the review. Changes are saved as a new version and approved by the access control administrator.
| Setting | Default | Choose from |
|---|---|---|
| Leaver: badge and remote access | 24 hours | CIP-004 R5.1 · mover access not needed: end of next day (R5.2) · accounts and shared passwords: 30 days (R5.3, R5.4) |
| Warn owners at | 50% and 80% | Share of each clock used |
| Unused after | 90 days | Days without a logon before a right is flagged on the card |
| Role fit below | 20% | Share of the person's current peers holding the role |
| Training and risk assessment due within | 30 days · 60 days | CIP-004 R2.3, every 15 months · CIP-004 R3, every 7 years |
| Suggest a decision on each card | On | On · Off — owners still decide every right |
| Re-read the target system within | 2 minutes | After the change is sent · retry every 15 minutes · alarm after 2 hours · a revocation closes only when the re-read confirms it, which cannot be turned off |
| Evidence pack check and signature | Helena Marsh · Owen Castellano | CIP compliance lead checks · CIP Senior Manager signs · second approver for a flagged privileged keep with no record: Amara Quist |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of a spreadsheet review cycle, about 6 days a quarter for 412 rights, to be measured in a pilot · “typical” = published figures: NERC CIP-004-7 (R4.2 quarterly verification, R5.1 removal within 24 hours, R5.2 next day); FERC civil penalty maximum $1,584,648 per violation per day (Federal Register, 14 Jan 2025), quoted as exposure, not savings. People, Lumina Utilities, its systems, sites, suppliers and records named on this page are fictional — characters and sample data in the working solution.
Software that runs the periodic check that everyone with access to grid control systems and control-room badge zones still needs it and is authorized for it, and proves what was removed. User Access Review gives each system owner a deck of cards, one access right per card with its evidence, and re-reads the target system after every revoke to prove the access is gone.
Each quarter opens a review for every system in scope. Overnight, the agents read accounts, groups and badge zones read-only, join them to HR, and check last use, role fit, the authorization record, training and the personnel risk assessment. Each owner decides their rights from a deck, with owners reminded at 50 % and 80 % of the quarter, and the quarter ends in a dated evidence pack by requirement.
When an owner revokes, the removal agent sends the change through the system's provisioning connection, then re-reads the target system within 2 minutes. If the account, group or zone is gone, it files a receipt with the before and after, the read time and a fingerprint. If not, the revocation stays open, retries every 15 minutes and alarms the access control administrator after 2 hours.
Yes. Each event in the hourly HR feed starts the clock it needs: badge and Interactive Remote Access within 24 hours for a leaver (R5.1), access not needed by the end of the next day for a mover (R5.2), and accounts and shared passwords within 30 days (R5.3, R5.4). In the sample quarter, 9 of 9 leavers and movers were inside their clock.
It is built to give owners something to judge. Each card shows the last use and a usage strip, how many of the person's current peers hold the role, the HR event and the records, with a suggestion and its reason. A flagged right kept needs a reason, and a flagged privileged right with no authorization record needs a second approver.
In the working solution the review covers six systems: the EMS, the remote access gateway, the historian, control-room badge zones, substation engineering access and a water treatment works SCADA, which is in scope by utility policy and ISO 27001 A.5.18. The agents read every system read-only and change only access an owner revoked.
Yes. Agents gather evidence and suggest; system owners decide every right and sign an attestation for their system. The CIP compliance lead checks the evidence pack and the CIP Senior Manager signs it, and nothing in a signed pack can be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your access review procedure, your HR, badge and account lists, and your CIP-004 evidence practice — and it goes live once every quality gate has passed. We will walk you through it on a sample of your own lists first.
Audit binders built continuously, not in a 30-day scramble.
1-min demoThird-Party Cyber Risk ManagementEvery supplier answer checked against its evidence before you sign.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoWe'll run User Access Review on a sample of your own HR, badge and account lists.