Access Reviews and Audits
Periodic review of staff and broker access to systems that store consumer data.
1. Purpose
JRJ Group Holdings LLC D/B/A UNIFY reviews access to UNIFY on a set schedule so accounts that no longer need consumer data are removed.
2. Cadence
- Quarterly. Review all admin and editor accounts, production cloud consoles—including hosting, database, object storage, and email—and any account that can decrypt SSN, date of birth, or EIN.
- Quarterly. Review broker accounts: disable brokers who are no longer partners and confirm pending brokers have not been approved by mistake.
- On termination. Same-day disablement of staff identity in UNIFY and hosted consoles.
- After incidents. Conduct an additional review of the affected system.
3. What is reviewed
- Whether each user still needs their role
- Whether brokers remain approved and active
- Whether any user can open the admin application who should not
- Whether shared or generic accounts exist; they are not allowed for staff
- Whether MFA is still enrolled on in-scope systems
4. Evidence
Each review produces a dated record: reviewer, system, accounts removed or changed, and exceptions. Records are kept for at least one year, aligned with the Data Deletion and Retention Policy.
5. Audits
Management may run additional audits of access logs, failed logins, and document downloads. Findings feed the Information Security Policy annual review.