VA SERVICE ACCESS REGISTER

One entry per system or restricted work area. Keep the register private.

System and business owner:
Business-controlled recovery owner:
Named provider account:
Required service action:
Actions reserved for the client:
Actual role granted and documentation checked:
Account/organisation eligibility and administrator approval checked:
Folder/group/inherited access also present:
Source files outside editable parent folders where read-only access is required:
Sensitive information visible:
MFA and approved device arrangements:
Permitted downloads and retention:
Approved helpers, if any:

Rehearsal evidence, using non-sensitive test material:
Allowed action attempted and result:
Forbidden action safely checked and result:
Unrelated information visibility checked:
Mismatch and corrective action:

Grant date and approving person:
Review trigger/date:
Withdrawal method, including groups, sessions or integrations as relevant:
Exit handover and retention/deletion responsibilities:
Incident contact and how to report a suspected exposure:

Do not record passwords, one-time codes or recovery codes in this register. A documented policy is not proof that the software enforces it.