WI-118

Access review evidence is not captured for service accounts

Open

PLPlatform Control AU-6 Opened 16 Aug 2026 Last activity 14:02Z

Acceptance criteria

3 of 4 met

Service accounts appear in the quarterly review exportVerified against the 21 Aug export · 2 files attached
Review covers all three environments
Runbook updated with the new stepPR #482, merged 09:41Z
Platform lead has countersignedOutstanding — closing now records this as an unknown, not as met

Resolution Required before closing

Outcome

Resolved — evidence now captured Marks AU-6 as evidenced for this assessment period Accepted risk Requires a named accepting owner and a review date Not applicable The control does not apply to this boundary

Resolution note Quoted verbatim in the assessment. Write it for the auditor, not for the team.

Evidence

access-review-2026-Q3.csv412 KB
runbook-diff.pdf88 KB

Activity 4 entries

Delivery lead14:02Z · today

Export confirmed across all three environments. Countersign is the only thing outstanding.

Platform09:41Z · today

Runbook merged — PR #482.

Item

Reference: WI-118
Type: Finding
Priority: Medium — needed before sign-off
Owner: Platform
Opened: 16 Aug 2026

AU-6

Audit record review, analysis and reporting

NIST SP 800-53 Rev. 5 · 2 open findings

One criterion unmet

Closing records the countersign as an unknown rather than as met.

What closing writes

An immutable entry against engagement G8V-2026-014. It cannot be edited — only superseded.

LOG WI-118 resolved · AU-6 · 2 artifacts · 1 unknown

Final step — confirmation

An irreversible action enumerates what it will write. Prose saying “this cannot be undone” is not the same artifact as a list the user can check.