LensReading which lens this session carries.
All controls

CTL-001 · Access and authority

Privileged role assignment is recertified

Every holder of an enterprise or function scope role is confirmed by a named person each quarter, or the role is withdrawn.

Ineffective
Domain
Access and authority
Scope
enterprise
Frequency
quarterly
Operation
Manual
Control owner
Head of Platform Security · security
Tester of record
internal-audit
Last tested
Jul 15, 2026
Next due
Oct 13, 2026 · in 56d

What counts as evidence for this control

Written before the test, so a tester cannot choose the evidence that suits the result

Recertification list with a signature and a date per holder.

Test history

2 tests on record

69 items sampled
TestPeriodSample methodSizePassFailResultTesterTested
CT-001-01Q3 month 1 2026random attribute sample25223FailS. Nakamura
Internal Audit
Jul 15, 2026
CT-001-02Q2 2026random attribute sample44440PassD. Okoye
Internal Audit
Apr 14, 2026

Exceptions raised against this control

1 still open of 1

EXC-002Quarterly recertification was not completed for the break-glass groupmediumopen · due Aug 26, 2026

The two break-glass holders were not recertified in the last cycle. Neither activated the role, so there is no evidence of harm, and there is also no evidence the holders are still correct.

Owner
Head of Platform Security · security
Remediation
Recertify both holders and add the group to the standard quarterly list rather than treating it as an exception.

What this page is, and what it is not

Read this before quoting a result

The test results on this page are a modeled test history for a modeled estate. They demonstrate the shape of independent control testing — a named tester outside the operating team, a stated sample method, a sample size, a pass and fail count, and evidence citations that resolve into the chain — not the audited results of a live enterprise.

8 of 8 evidence citations on this control resolve to a record in the evidence spine. Every citation resolves; each one links through to the sealed record it refers to.

A control shown as untested has no result at all. Coverage on this platform counts controls that were actually tested; it never counts a control as passing because it was designed.