Monitoring Compliance Requirements with Lumos

​

Background

Lumos Analytics for Compliance Reporting shows whether your user Access Reviews are on track, how effectively you remove terminated accounts and manage access to sensitive applications, and how your reviews are progressing. Use it to report to leadership and identify where to improve access management for your most sensitive systems.

​

Quarterly Access Review Snapshot

At a glance, gain quick insights into your in-scope applications and understand how many are in need of review as defined by common SOC2, SOX, ISO 27001, PCI, HITRUST and other standard user access review requirements.

​

Overall Review Metrics

1. In-Scope Apps — the number of apps manually selected as in scope. By default, Lumos initially selects the apps included in any historical access reviews.
2. Apps Requiring Review —any in-scope app that has not had an access review completed in the standard audit window of 90 days.

​

Upcoming Review Deadlines

Stay on top of deadlines for ongoing access reviews involving relevant apps. Monitor:

• Time left until the next review deadline
• Any overdue reviews
• Progress with a simple completion bar showing the # of app reviews completed out of the total

​

Review History

View the last review date of your most sensitive apps, enabling you to identify candidates for user access reviews.

​

Understanding Trends in High-Risk Access

Track and monitor how effectively you are removing terminated employee access for all in-scope apps. Identify apps with potential offboarding gaps by reviewing the per-app breakdown of total terminated accounts, enabling you to initiate a user access review and take action to remove unnecessary access.

​

Understanding the Impact of your Access Review

Report on the volume of work done over the course of your review in terms of # of accounts reviewed and see how that trends over time with Lumos.

​

Volume of Reviewed Accounts

• View the total number of accounts reviewed
  • For a permission-based review, an account is counted if any permission has been reviewed for that account.
• View trend for the Last Month, 3 Months, 6 Months and 12 Months.
• View trend as a Weekly or Monthly time series.

​

Volume of Rejected Accounts

• Monitor how the total access that required removal during access reviews changes over time with Lumos.
• Report on progress being made to remove unnecessary access and assess whether you’re successfully reducing the frequency of unnecessary access cases that require removal over time.

​

Breakdown of Apps with Rejected Accounts

• Analyze the app-specific breakdown of rejected access to pinpoint apps potentially lacking sufficient access controls, leading to extensive access removal during reviews, particularly terminated access.

​

Review Decision Breakdown

• View and report on the overall review progress across your app reviews.
• Share the final decision breakdown for recently completed reviews.
• Toggle by account/ permission reviews to see the respective decision breakdowns by review types
  • See the accepted/ rejected/ modified breakdown by the total # of accounts across all account reviews
    OR
  • See the accepted/ rejected/ modified breakdown by the total # of permissions reviewed across all permission based reviews

​

FAQ

​

How did Lumos identify my in-scope applications?

When you initially join Lumos, your list of in-scope apps will be empty. Lumos then monitors your activity daily to identify whether you have initiated any user access reviews. This ongoing monitoring allows the system to automatically identify potential apps that should undergo compliance review. It’s important to note that after the initial attempt to populate this list of applications, automatic updates do not occur. However, you have the flexibility to manually update or modify the selected applications at any time in the future to ensure their accurate classification.

​

How are you calculating the counts for accounts reviewed?

Lumos supports two primary types of user Access Reviews: account reviews and permission level reviews. Here’s how they contribute to this total count: Account Reviews: During the chosen time frame, an account is counted in the review process if it was included in the review for any in-scope applications. In other words, if it’s considered relevant to the review criteria, it’s included in the count. Permission Level Reviews: Similarly, for permission level reviews during the selected time period, an account is counted if at least one permission associated with that account has been reviewed for any in-scope applications. In essence, any account that has had even a single permission reviewed is considered in the count for permission level reviews.

​

Why am I not seeing any data for terminated employee access?

Lumos began collecting this data for customers starting on January 7th. As a result, any information prior to this date is not included in the chart displaying terminated employee access.

​

Why am I seeing terminated employee access for some accounts that I removed in an access review?

Most likely these accounts were removed in the user access review of a manual application. Today in Lumos, until you upload a new user list for manual applications, Lumos considers those potentially active accounts for reporting purposes.

​

How do I stop seeing test reviews as upcoming reviews?

Any reviews that are currently in progress are automatically included in your Upcoming Review Deadlines report. You have the option to either complete these ongoing reviews or remove them from the list by deleting them from your in-progress reviews.

​

How does Lumos determine which apps are requiring review?

Lumos follows the industry norm of a 90-day window for quarterly access reviews, in line with standards such as SOC2, SOX, HITRUST, and ISO27001. If an in-scope application has not undergone a user review within the last 90 days, it is classified as requiring review.