{"$schema":"https://json-schema.org/draft/2020-12/schema","title":"Access Review","description":"Periodic user-access rights review for a system, evidencing the recertification required by ISO/IEC 27001:2022 control A.5.18 (access rights), NIS2 Art. 21(2)(i) and Art. 32 GDPR (appropriateness of technical and organisational measures).","type":"object","additionalProperties":false,"required":["entity","system_name","review_period","reviewer","users","summary","follow_up_actions","sign_off"],"$defs":{"user_line":{"type":"object","additionalProperties":false,"required":["user_id","full_name","role","access_level","rationale","decision"],"properties":{"user_id":{"type":"string"},"full_name":{"type":"string"},"role":{"type":"string"},"access_level":{"type":"string"},"last_login":{"type":"string","format":"date"},"rationale":{"type":"string"},"decision":{"type":"string","enum":["keep","revoke","adjust"]},"adjusted_access":{"type":"string"},"reviewer_notes":{"type":"string"}}},"sign_party":{"type":"object","additionalProperties":false,"required":["name","title"],"properties":{"name":{"type":"string"},"title":{"type":"string"},"signature_placeholder":{"type":"string"}}}},"properties":{"entity":{"type":"object","additionalProperties":false,"required":["name","registration"],"properties":{"name":{"type":"string"},"registration":{"type":"string"},"address":{"type":"string"}}},"system_name":{"type":"string"},"system_description":{"type":"string"},"review_period":{"type":"object","additionalProperties":false,"required":["from","to"],"properties":{"from":{"type":"string","format":"date"},"to":{"type":"string","format":"date"}}},"reviewer":{"type":"object","additionalProperties":false,"required":["name","title"],"properties":{"name":{"type":"string"},"title":{"type":"string"}}},"users":{"type":"array","minItems":1,"items":{"$ref":"#/$defs/user_line"}},"summary":{"type":"object","additionalProperties":false,"required":["total_users","kept","revoked","adjusted"],"properties":{"total_users":{"type":"integer","minimum":0},"kept":{"type":"integer","minimum":0},"revoked":{"type":"integer","minimum":0},"adjusted":{"type":"integer","minimum":0}}},"follow_up_actions":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["action","owner","due_date"],"properties":{"action":{"type":"string"},"owner":{"type":"string"},"due_date":{"type":"string","format":"date"}}}},"sign_off":{"type":"object","additionalProperties":false,"required":["reviewer","business_owner","date"],"properties":{"reviewer":{"$ref":"#/$defs/sign_party"},"business_owner":{"$ref":"#/$defs/sign_party"},"date":{"type":"string","format":"date"}}}}}