Access review হলো account এখনো দরকার, authorized owner ও controlled recovery আছে, unexplained session/app নেই—এর periodic check। useful result screenshot নয়; completed change-এর evidence-সহ account-প্রতি dated decision।
এই list legitimate agency, QA, research ও automation operation-এর Gmail, Yahoo ও Outlook-এর জন্য। security guide-কে complete করে: guide control বলে, list verify ও ownership gap close করে।
Account খোলার আগে review define
scope, reviewer, evidence ও deadline দিয়ে শুরু। client, project, provider, environment না সব—কী cover ঠিক করুন। need-এর business owner ও security technical reviewer assign করুন। small team-এ এক person হলেও decision ও evidence আলাদা রাখুন।
Microsoft guidance resource, population, frequency, reviewer, deadline ও action define করতে বলে। separate account-এও model useful।
| Field | Question | Safe evidence |
|---|---|---|
| Purpose/owner | কেন আছে, কে accountable? | approved request/project record |
| Provider/status | active, suspended না retired? | provider screen বা dated record |
| Recovery | team recover করতে পারে? | code ছাড়া method/custodian record |
| Session/device | সব access expected? | exception review list |
| App | প্রতি integration-এর purpose? | approved list ও removal record |
| Decision | keep, modify, suspend, retire? | reviewer, reason, implementer, completion |
Secret spreadsheet থেকে দূরে
register address, owner, status ও vault reference রাখে; password, passkey, recovery code, API key বা full export নয়।
Access review চালান
- 1scope freeze, register copy ও date।
- 2account purpose/owner-এর সঙ্গে মিলিয়ে orphan flag।
- 3code collect না করে recovery/auth verify।
- 4activity, device ও session review; unknown investigate।
- 5app/permission review; unneeded integration, app password ও forwarding remove।
- 6decision record; remediation-এ implementer ও due date।
- 7provider-এ completion verify, minimum evidence ও next trigger schedule।
last activity একমাত্র rule নয়। test, incident বা seasonal project account intentionally idle হতে পারে; recent activity authorization proof নয়। activity-কে purpose, owner decision ও expected integration-এর সঙ্গে দেখুন।
Provider-specific evidence
Google-এ device guide session review/sign-out এবং app review দেয়। sensitive content নয়, outcome record করুন।
Microsoft-এ sign-in activity ও security info review। departing employee email permanent recovery নয়।
Yahoo-তে security activity guide login, connection ও change review বলে। connection remove-এ app password-ও delete লাগতে পারে। project flow না ভেঙে integration intended কি না দেখুন।
Provider interface আলাদা
current provider label/path নিন। session, app, alias ও recovery model আলাদা হলে Gmail, Yahoo ও Outlook evidence জোর করে same column-এ নয়।
Finding-কে controlled action করুন
| Decision | কখন | Follow-up |
|---|---|---|
| Keep | purpose, owner, access, security current | reviewer ও next trigger |
| Modify | needed কিন্তু ownership/recovery/session/app wrong | fix assign ও new state verify |
| Suspend | use unclear, disputed বা investigated | evidence preserve ও policy অনুযায়ী block |
| Retire | purpose ended বা authorized owner নেই | integration remove, access revoke, retention apply, row close |
unexpected access routine cleanup নয়, security incident। provider compromised-account process, owner notification ও minimum evidence নিন। control bypass বা similar account তৈরি নয়।
Risk অনুযায়ী cadence
এক universal interval নেই। account value, operator, system, client obligation ও legal requirement অনুযায়ী। high-impact/shared pool isolated temporary test-এর চেয়ে ঘন।
- owner, contractor, client বা project change-এ review।
- suspected compromise, recovery change বা unknown session-এ immediate review।
- temporary QA/research account cycle/retention end-এ।
- uncertain row-এর backup reviewer ও escalation।
- checked box নয়, verified action-এ completion।
NIST পাসওয়ার্ড নির্দেশিকায় unique password, password manager ও MFA recommend করে। review secret expose না করে control verify করবে।
MailCreator account review cycle-এ নিন
MailCreator name, recovery, status ও CSV-সহ Gmail, Yahoo ও Outlook task দেয়। authorized batch-এর পর file secure storage-এ, account register-এ match, purpose/owner/recovery custodian/status/next trigger যোগ ও extra copy delete করুন।
operation organize-এ provisioning workflow দিয়ে শুরু ও list regularly নিন। register ready হলে প্ল্যান তুলনা বা account তৈরি।
account creation spam, impersonation, misleading identity বা protection bypass-এর permission নয়। approved purpose ও provider/privacy/retention/communication rule মানুন।