## Chapter 9 — The 90-day access review is still missing ### Lesson map Lesson 09. Map, example, EX055. ```mermaid flowchart TD A["Two different rows mention 90 days"] --> B["Backup restore is met"] B --> C["Vendor-access review is not"] C --> D{"May one row close the other?"} D -->|No| E["Keep the access gap and invent no date"] ``` The shared phrase "90 days" does not make the rows the same check. ### Logical drawing ```text met backup restore tested in the last 90 days unmet vendor access reviewed in the last 90 days absent a calendar date for that review ``` ### Learning outcomes After this chapter, you should be able to: 1. Tell the access-review row from the backup-restore row. 2. Keep the access review unmet. 3. Refuse to invent the date of a review. ### 9.1 One phrase, two rows, and no date. Vendor access means the people on the vendor's side who can still reach the loyalty setup. A review of that access asks who those people are and whether they should still have it. The checklist wants the review to have happened in the last 90 days. The source marks that row unmet, and the print lists it as a gap. A different row uses the same window: backup restore tested in the last 90 days. That row is marked met. A reader who sees "90 days" twice can slide the pass across. The pass belongs only to the restore test. It says nothing about who at the vendor can still act. The manuscript never prints a calendar date for an access review, so there is no day to calculate the 90 days from. The decision note's review date, which later lessons keep unprinted, is also not this access review. Inventing a day, a month, or a year would make the gap look closed without evidence. The vendor's agreement to fix the row remains the promise from chapter 4. It is not a dated review slipped into the margin. ### 9.2 Worked example Match each 90-day phrase to its own row before you decide. | Row | Source | What a note may say | |---|---|---| | Backup restore tested in the last 90 days | Met | The restore test is the passing row | | Vendor access reviewed in the last 90 days | Unmet | The access gap stays | | A calendar date for the access review | Not printed | Do not invent one | | "The restore pass closes the access gap." | No such transfer | Refuse | > **Synthetic case.** Neither row names a real vendor employee. No review meeting is dated. ### Errors and limits A passing restore test can coexist with a missing access review. Similar wording is not shared evidence. ### Apply - **EX055 — Which 90-day row failed?** The print gaps the vendor-access review and does not gap the backup restore. Both phrases say "the last 90 days." Has the access review happened, and what date do you write? *Rubric:* 3 = vendor access still has not been reviewed in the last 90 days; the backup-restore row stays a separate pass; no review date is invented;; 2 = the access gap stays and no date is added;; 1 = one row;; 0 = none. ### Continue studying — lesson 09 (chapter 09 of 20) [← Chapter 08](#ch-08) · [Course chapter index](../SUBJECTS.md) · [Chapter 10 →](#ch-10) Continue to the next authored lesson. ## Worked answers **EX055.** No. Vendor access still has not been reviewed in the last 90 days. Do not invent a date.