Annual and Quarterly Review Checklist

Purpose: Recurring security review items that must be completed on schedule. Owner: Rory (sole IT/security) with Kobe assistance Compliance: SOC2 CC6.x, HIPAA §164.308(a)(1)(ii)(D) (information security officer)

---

Quarterly Reviews (Q1/Q2/Q3/Q4)

Least Privilege Audit (LPRIV — LPRIV-019/LPRIV-020)

When: January, April, July, October (first week) Automated check: pim-audit.yml runs weekly and includes LPRIV baseline checks

Quarterly manual review:

• [ ] Run pim-audit.yml manually and verify LPRIV baseline job passes
• [ ] Review security/lpriv-baseline.md — confirm expected counts still match intent
• [ ] Verify secops_app PostgreSQL grants: connect to psql-secops-prod and run \du secops_app and \dp
• [ ] Verify Cortex XDR API key role = Viewer in Cortex XDR console
• [ ] Review any new service identities added since last audit (check KV, GitHub secrets, Entra)
• [ ] If any deviation from baseline: open a LPRIV story and remediate before quarter end
• [ ] Update security/lpriv-baseline.md with any intentional changes and date

Reference: security/lpriv-baseline.md, compliance/lpriv-secops-audit.md, compliance/lpriv-cicd-audit.md, compliance/lpriv-ops-automation-audit.md

PIM Eligible Roles Review

When: Quarterly (coincides with LPRIV review) Automated check: pim-audit.yml weekly

• [ ] Review PIM role eligibility report email for unexpected roles
• [ ] Confirm all PIM-eligible roles have time-bound activation requirements
• [ ] No permanent active assignments for privileged roles (Global Admin, etc.)

Key Vault Secret Rotation

When: Quarterly or per-expiry (whichever is sooner)

• [ ] Check KV secret expiry dates via az keyvault secret list --vault-name cirius-openai-kv-prod
• [ ] Rotate any secrets expiring within 60 days
• [ ] Update dependent application config after rotation

---

Semi-Annual Reviews (H1/H2)

DR Test

When: Q2 (June) and Q4 (November) Stories: DR-004 through DR-015

• [ ] Execute Veeam replica boot (RTO measurement)
• [ ] Execute RSV database restore (data integrity check)
• [ ] Application smoke tests post-failover
• [ ] Results documented and uploaded as audit evidence
• [ ] incident-response.md updated with lessons learned

HIPAA Risk Assessment

When: Annually (can coincide with H1 DR test)

• [ ] Review all PHI flows and access controls
• [ ] Update risk register with new findings
• [ ] Confirm BAA inventory is current (compliance/ directory)
• [ ] Adriana uploads updated risk assessment to SharePoint

Break-Glass Account Review

When: Semi-annual

• [ ] Verify all 18 break-glass accounts are in password manager (Keeper)
• [ ] Verify Greg and Kevin have physical access to offline BGKIT
• [ ] Confirm break-glass accounts are NOT in any suppression lists
• [ ] Test one break-glass account login (generates CRITICAL alert — verify alert fires)

---

Annual Reviews

SOC2 / HIPAA Evidence Package

When: Q4 (for annual audit cycle)

• [ ] Pull all compliance audit evidence from S3 WORM archive
• [ ] Verify 6-year retention: archive bucket Object Lock settings unchanged
• [ ] Update SOC2 CC6.3 and HIPAA 164.312(a)(1) mapping (compliance/lpriv-evidence-mapping.md)
• [ ] Compile LPRIV evidence: all audit docs, LPRIV baseline, remediation proofs
• [ ] Compile PIM evidence: quarterly PIM audit reports + email records
• [ ] Adriana to upload to SharePoint compliance folder

Encryption Key Rotation

When: Annually

• [ ] Rotate all CMK keys in prod, firewall, identity Key Vaults
• [ ] Rotate cirius-prod-cmk-key, cirius-firewall-cmk-key, cirius-id-cmk-key
• [ ] Verify Disk Encryption Sets continue to function after key rotation
• [ ] Update key expiration dates in Terraform if applicable

Security Awareness Training

When: Annually (and when new staff join) Stories: COMP-007, COMP-008

• [ ] All staff complete security awareness training
• [ ] Phishing simulation run (via KnowBe4 or equivalent)
• [ ] Training completion records stored in SharePoint
• [ ] HIPAA training specifically documented for compliance

Access Control Review

When: Annually Story: COMP-012

• [ ] Full user/permission audit across all systems
• [ ] Remove access for any departed staff
• [ ] Review admin group membership (Domain Admins, Global Admins)
• [ ] Review PIM assignments — remove any that are no longer needed
• [ ] Document review completion with timestamp

---

Review History

Date	Review Type	Completed By	Notes
April 2026	Quarterly LPRIV (Q2)	Kobe	LPRIV-001 through LPRIV-018 complete