The 90-day access review is still missing

Lesson map

Lesson 09. Map, example, EX055.

flowchart TD
  A["Two different rows mention 90 days"] --> B["Backup restore is met"]
  B --> C["Vendor-access review is not"]
  C --> D{"May one row close the other?"}
  D -->|No| E["Keep the access gap and invent no date"]

The shared phrase "90 days" does not make the rows the same check.

Logical drawing

met
    backup restore tested in the last 90 days
unmet
    vendor access reviewed in the last 90 days
absent
    a calendar date for that review

Learning outcomes

After this chapter, you should be able to:

1. Tell the access-review row from the backup-restore row.
2. Keep the access review unmet.
3. Refuse to invent the date of a review.

9.1 One phrase, two rows, and no date.

Vendor access means the people on the vendor's side who can still reach the loyalty setup. A review of that access asks who those people are and whether they should still have it. The checklist wants the review to have happened in the last 90 days. The source marks that row unmet, and the print lists it as a gap. A different row uses the same window: backup restore tested in the last 90 days. That row is marked met. A reader who sees "90 days" twice can slide the pass across. The pass belongs only to the restore test. It says nothing about who at the vendor can still act. The manuscript never prints a calendar date for an access review, so there is no day to calculate the 90 days from. The decision note's review date, which later lessons keep unprinted, is also not this access review. Inventing a day, a month, or a year would make the gap look closed without evidence. The vendor's agreement to fix the row remains the promise from chapter 4. It is not a dated review slipped into the margin.

9.2 Worked example

Match each 90-day phrase to its own row before you decide.

Lesson table; scroll horizontally to read all columns →

Synthetic case. Neither row names a real vendor employee. No review meeting is dated.

Errors and limits

A passing restore test can coexist with a missing access review. Similar wording is not shared evidence.

Apply

• EX055 — Which 90-day row failed? The print gaps the vendor-access review and does not gap the backup restore. Both phrases say "the last 90 days." Has the access review happened, and what date do you write?
  Show marking criteria

  Rubric: 3 = vendor access still has not been reviewed in the last 90 days; the backup-restore row stays a separate pass; no review date is invented;; 2 = the access gap stays and no date is added;; 1 = one row;; 0 = none.