{"entity":{"name":"Acme Supplies SRL","registration":"BE0123456789","address":"Rue de la Loi 100, 1000 Brussels, Belgium"},"system_name":"Acme CRM (Salesforce)","system_description":"Customer relationship management system holding prospect, customer, opportunity and pipeline data. In scope: standard users, power users, system administrators.","review_period":{"from":"2026-01-01","to":"2026-03-31"},"reviewer":{"name":"Thomas Janssens","title":"IT Operations Manager"},"users":[{"user_id":"ajanssens","full_name":"Andreas Janssens","role":"Sales representative","access_level":"Standard user","last_login":"2026-03-28","rationale":"Active sales rep, quarterly quota holder.","decision":"keep"},{"user_id":"bdelvaux","full_name":"Benoît Delvaux","role":"Sales representative","access_level":"Standard user","last_login":"2026-03-30","rationale":"Active sales rep, BE South region.","decision":"keep"},{"user_id":"cdepauw","full_name":"Caroline De Pauw","role":"Sales representative","access_level":"Standard user","last_login":"2025-11-12","rationale":"On parental leave until 2026-06; maintains active access to avoid re-onboarding.","decision":"keep","reviewer_notes":"Confirmed with HR (Marie Laurent) that leave is active."},{"user_id":"dmartens","full_name":"Dirk Martens","role":"Sales representative","access_level":"Standard user","last_login":"2025-09-02","rationale":"Left the company 2025-10-31; access should have been revoked at offboarding.","decision":"revoke","reviewer_notes":"Gap in the offboarding process. Escalated to HR and IT service desk."},{"user_id":"eleroy","full_name":"Pierre Leroy","role":"Sales representative","access_level":"Standard user","last_login":"2026-03-31","rationale":"New hire 2025-09-15, ramping.","decision":"keep"},{"user_id":"fdupont","full_name":"Fabien Dupont","role":"Sales manager","access_level":"Power user (team scope)","last_login":"2026-03-31","rationale":"Manages BE sales team, needs visibility on team pipeline.","decision":"keep"},{"user_id":"gmartens","full_name":"Sophie Martens","role":"Operations director","access_level":"Read-only (all accounts)","last_login":"2026-03-24","rationale":"Needs visibility on key accounts for operational planning.","decision":"keep"},{"user_id":"hvermeulen","full_name":"Catherine Vermeulen","role":"Legal counsel","access_level":"Power user (all accounts)","last_login":"2026-02-10","rationale":"Previously needed wide access for contract review; scope now reduced — adjust to read-only on contract entity only.","decision":"adjust","adjusted_access":"Read-only, Contracts object only","reviewer_notes":"Least-privilege alignment per ISO 27001 A.5.15."},{"user_id":"ipeeters","full_name":"Luc Peeters","role":"Warehouse supervisor","access_level":"Standard user","last_login":"2025-12-18","rationale":"Legacy access from pilot integration with WMS; no longer needed.","decision":"revoke"},{"user_id":"jdesmet","full_name":"An De Smet","role":"HR business partner","access_level":"Standard user","last_login":"2025-08-22","rationale":"No business need established for HR persona; likely legacy.","decision":"revoke"},{"user_id":"kjanssens","full_name":"Thomas Janssens","role":"IT operations manager","access_level":"System administrator","last_login":"2026-03-31","rationale":"Primary system admin; break-glass account monitored separately.","decision":"keep"},{"user_id":"lvan","full_name":"Jeroen Van Hove","role":"IT junior admin","access_level":"System administrator","last_login":"2026-03-29","rationale":"Supports day-to-day ops; admin scope remains justified.","decision":"keep"},{"user_id":"mintegr","full_name":"svc-integration","role":"Service account (middleware)","access_level":"API integration user","last_login":"2026-03-31","rationale":"Used by the middleware for nightly sync; key rotated 2026-01-15.","decision":"keep","reviewer_notes":"Ownership confirmed with Jeroen Van Hove."},{"user_id":"nmartin","full_name":"Nora Martin","role":"Marketing analyst","access_level":"Standard user","last_login":"2026-03-30","rationale":"Needs campaign and lead data.","decision":"keep"},{"user_id":"omeyer","full_name":"Olivier Meyer","role":"Marketing analyst","access_level":"Power user (marketing objects)","last_login":"2026-03-30","rationale":"Power access beyond current role; reduce to standard.","decision":"adjust","adjusted_access":"Standard user"},{"user_id":"pmoreau","full_name":"Pauline Moreau","role":"Customer success","access_level":"Standard user","last_login":"2026-03-31","rationale":"Active CS agent.","decision":"keep"},{"user_id":"qdewinter","full_name":"Quentin Dewinter","role":"Customer success","access_level":"Standard user","last_login":"2026-03-27","rationale":"Active CS agent.","decision":"keep"},{"user_id":"rvanhove","full_name":"Rita Van Hove","role":"Finance controller","access_level":"Read-only","last_login":"2026-03-20","rationale":"Reads invoiced-opportunity data for AR reconciliation.","decision":"keep"},{"user_id":"sbakker","full_name":"Sander Bakker","role":"Consultant (external)","access_level":"Power user (time-bound)","last_login":"2025-10-02","rationale":"Engagement ended 2025-09-30; access should have been time-expired.","decision":"revoke","reviewer_notes":"SSO should have auto-disabled; confirmed AD account is already disabled, removing CRM-side licence."},{"user_id":"tlaurent","full_name":"Marie Laurent","role":"DPO / Legal counsel","access_level":"Read-only audit log","last_login":"2026-03-05","rationale":"Oversight access to data-subject records and audit log per Art. 37-39 GDPR.","decision":"keep"},{"user_id":"udurand","full_name":"Isabelle Durand","role":"Managing director","access_level":"Read-only (executive dashboard)","last_login":"2026-03-28","rationale":"Executive-level reporting only.","decision":"keep"},{"user_id":"vkoch","full_name":"Valérie Koch","role":"Sales representative (DE market)","access_level":"Standard user","last_login":"2026-03-31","rationale":"Active rep covering Müller Industrie GmbH account.","decision":"keep"},{"user_id":"wnguyen","full_name":"William Nguyen","role":"Sales representative (NL market)","access_level":"Standard user","last_login":"2026-03-30","rationale":"Active rep covering Van Dijk BV accounts.","decision":"keep"},{"user_id":"xinterim","full_name":"svc-bi-export","role":"Service account (BI export)","access_level":"API read-only","last_login":"2026-03-31","rationale":"Nightly export to Power BI; scope limited to aggregate objects.","decision":"keep"}],"summary":{"total_users":24,"kept":19,"revoked":4,"adjusted":2},"follow_up_actions":[{"action":"Revoke access for 4 users identified (Dirk Martens, Luc Peeters, An De Smet, Sander Bakker) within 5 business days.","owner":"Jeroen Van Hove","due_date":"2026-04-10"},{"action":"Adjust access scope for Catherine Vermeulen and Olivier Meyer.","owner":"Jeroen Van Hove","due_date":"2026-04-10"},{"action":"Update offboarding checklist: add explicit CRM licence removal step to close the gap identified for Dirk Martens.","owner":"An De Smet (HR)","due_date":"2026-04-30"},{"action":"Configure automated disablement of CRM SSO-linked accounts on AD disable event.","owner":"Thomas Janssens","due_date":"2026-06-30"}],"sign_off":{"reviewer":{"name":"Thomas Janssens","title":"IT Operations Manager","signature_placeholder":"(manual signature)"},"business_owner":{"name":"Fabien Dupont","title":"Head of Sales","signature_placeholder":"(manual signature)"},"date":"2026-04-03"}}