{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Access rights review - Revue des droits d'accès / Toegangsrechtencontrole (BE)","description":"The review by an enterprise, for one system and one period, of who has which access and the decision taken for each user (keep, revoke or adjust), with the typed counts, the follow-up actions and the sign-off of the reviewer and the business owner. No law makes this document mandatory. The template prints what the user typed: it chooses no decision, computes no count, states no conformity and states no NIS2 scope.","type":"object","additionalProperties":false,"required":["entity","system","review_period","reviewer","users","summary","sign_off"],"properties":{"entity":{"type":"object","additionalProperties":false,"required":["name"],"description":"The enterprise that reviews its own system.","properties":{"name":{"type":"string","description":"Name of the enterprise."},"enterprise_number":{"type":"string","pattern":"^[01][0-9]{3}\\.[0-9]{3}\\.[0-9]{3}$","description":"Belgian enterprise number (KBO/BCE), written 0123.456.789. Optional: this is an internal record."},"address":{"type":"string","description":"Address of the enterprise."},"gdpr_role":{"type":"string","enum":["controller","processor","both"],"description":"The enterprise's own statement of its role for the data of this system: controller, processor or both. Never decided by the template."}}},"nis2":{"type":"object","additionalProperties":false,"description":"The user's NIS2 statement.","properties":{"status":{"type":"string","enum":["not_in_scope","in_scope_important","in_scope_essential","unknown"],"description":"The user's answer on the NIS2 status of the enterprise: not_in_scope, in_scope_important, in_scope_essential or unknown. A statement of the user, never of the template."}}},"system":{"type":"object","additionalProperties":false,"required":["name","owner"],"description":"The system whose accesses are reviewed.","properties":{"name":{"type":"string","description":"Name of the system."},"description":{"type":"string","description":"What the system is and what the review covers."},"owner":{"type":"string","description":"Who owns the system in the enterprise."}}},"review_period":{"type":"object","additionalProperties":false,"required":["from","to"],"description":"The period the review covers.","properties":{"from":{"type":"string","format":"date","description":"First day of the period reviewed."},"to":{"type":"string","format":"date","description":"Last day of the period reviewed."}}},"reviewer":{"type":"object","additionalProperties":false,"required":["name","title"],"description":"Who carried out the review.","properties":{"name":{"type":"string","description":"Name of the reviewer."},"title":{"type":"string","description":"Function of the reviewer."}}},"users":{"type":"array","minItems":1,"description":"One line per user or account reviewed.","items":{"type":"object","additionalProperties":false,"required":["user_id","role","access_level","decision"],"properties":{"user_id":{"type":"string","description":"Identifier of the user or account in the system."},"name":{"type":"string","description":"Name of the user, or of the owner of a service account."},"role":{"type":"string","description":"Role or function of the user."},"access_level":{"type":"string","description":"Access level the user holds, in the enterprise's own words."},"last_used":{"type":"string","format":"date","description":"Date the access was last used."},"decision":{"type":"string","enum":["keep","revoke","adjust"],"description":"The decision taken for this user: keep, revoke or adjust. The reviewer chooses it."},"new_level":{"type":"string","description":"The access level after the adjustment. Required when the decision is adjust."},"justification":{"type":"string","description":"Why the decision was taken."},"done_on":{"type":"string","format":"date","description":"Date the decision was carried out."},"done_by":{"type":"string","description":"Who carried the decision out."}},"allOf":[{"if":{"properties":{"decision":{"const":"adjust"}},"required":["decision"]},"then":{"required":["new_level"]}}]}},"summary":{"type":"object","additionalProperties":false,"required":["total_users","kept","revoked","adjusted"],"description":"The counts as the user states them; the template computes none.","properties":{"total_users":{"type":"integer","minimum":0,"description":"Number of users reviewed."},"kept":{"type":"integer","minimum":0,"description":"Number of accesses kept."},"revoked":{"type":"integer","minimum":0,"description":"Number of accesses revoked."},"adjusted":{"type":"integer","minimum":0,"description":"Number of accesses adjusted."}}},"follow_up_actions":{"type":"array","description":"Actions that follow from the review.","items":{"type":"object","additionalProperties":false,"required":["action","owner","due_date"],"properties":{"action":{"type":"string","description":"The action."},"owner":{"type":"string","description":"Who is responsible for the action."},"due_date":{"type":"string","format":"date","description":"Date the action is due."}}}},"exceptions":{"type":"array","description":"Exceptions noted during the review, in the enterprise's own words.","items":{"type":"string"}},"sign_off":{"type":"object","additionalProperties":false,"required":["reviewer","business_owner","date"],"description":"Sign-off of the review.","properties":{"reviewer":{"type":"object","additionalProperties":false,"required":["name","title"],"properties":{"name":{"type":"string","description":"Name of the reviewer who signs."},"title":{"type":"string","description":"Function of the reviewer who signs."}}},"business_owner":{"type":"object","additionalProperties":false,"required":["name","title"],"properties":{"name":{"type":"string","description":"Name of the business owner who signs."},"title":{"type":"string","description":"Function of the business owner who signs."}}},"date":{"type":"string","format":"date","description":"Date of the sign-off."}}}}}