Run access reviews your auditor will accept.
Spreadsheet kits for IT and security teams that don't have an identity governance platform, built by a working IAM engineer.
Excel file. Free for internal use at your organization.
| Account | What the workbook found | Risk |
|---|---|---|
| rpatel | Terminated in HR, account still enabled | High |
| bjones | Not matched to HR; no login in 200 days | High |
| svc-scanner | Service account with no owner | High |
| tnguyen-adm | Privileged; mapped to tnguyen | Medium |
| lwilson | On leave, account enabled | Medium |
| jsmith | None | Low |
Paste in your extracts. The workbook does the triage.
Drop in account exports from each system and your HR roster. Every row is checked against the same rules, so reviewers start with the access that matters instead of a wall of usernames.
- High Terminated, account enabled
- HR says the person left; the system says they can still sign in.
- High Not matched to HR
- No person behind the account. Alternate accounts like jdoe-adm map to their owner so they don't show up as false alarms.
- High No account owner
- Service, shared, and test accounts nobody is accountable for.
- Medium Privileged or inactive
- Admin rights, logins older than your threshold, never-used accounts. Both together is High.
- High Population problems
- Duplicate rows, systems outside your scope list, and totals that don't match the source system.
- Incomplete Missing or invalid inputs
- Blank reviewers, mistyped account types, missing login data. Flagged instead of quietly scored Low.
Built for the audit, not the demo.
Most free templates stop at a decision column. These are the parts auditors actually ask about.
A provably complete population
Record each source system's account total and see the variance before reviewers start, so nobody asks whether the extract was filtered.
Decisions that hold up
A record only counts as done with a final decision, a reviewer, a justification, and a date. Self-reviews and open escalations block the close.
Changes verified, not just ticketed
Every revoke tracks who made the change and a different person who confirmed it. Closure means verified, with an evidence checklist to match.
Next up: a phishing-resistant MFA rollout kit.
Everything needed to move a small organization to security keys and passkeys without flooding the help desk:
- Phased rollout playbook with go/no-go gates
- Key selection matrix and cost calculator
- Enrollment tracker
- User announcements, quick-start card, and FAQ
- Help desk runbook for lost and broken keys
- Policy and exception templates
Want to know when it's ready?
Get the free workbook and opt in to updates at checkout. You'll get one email when the kit ships. Nothing else.
Who makes these
CoffeeSecurity is run by an identity and access management engineer who manages SSO, directories, privileged access, and automated provisioning for a living, in a regulated industry where audits are routine.
The kits are the working documents I'd want on hand before an audit. They're vendor-neutral and built from public frameworks and hands-on experience. No employer's documents or data go into them.
Questions or corrections: hello@coffeesecurity.com.