12 Access Review Metrics Every CISO Should Track Quarterly

Every CISO gets asked the same question by the audit committee: is the access review program working? The honest answer requires numbers, not adjectives. These are the twelve that actually predict outcomes: audit findings, breach exposure, and license waste.

Track all twelve quarterly. Publish the four completion metrics inside the org. The rest live on your desk.

Which metrics track program completion?

Four metrics. These are the ones you publish and pin to a dashboard.

• Campaign duration. Days from launch to evidence bundle export. Target: 10 business days for quarterly reviews.
• Reviewer completion rate at cutoff. Percentage of assigned reviewers who submitted a decision on every assigned entitlement by the decision deadline. Target: 95%+.
• Escalation rate. Percentage of reviewers who required a manager-of-reviewer escalation. Target: 10 to 20%. Below 10%, you are being too slack on the deadline. Above 25%, reviewer routing is wrong.
• Revocation execution rate at close. Percentage of "revoke" decisions confirmed executed in the source system by campaign close. Target: 95%+.

These four are the operational heartbeat. If any one drops for two cycles running, the program is drifting.

Which metrics measure standing access risk?

Four metrics. These live on the CISO's desk and drive one-off remediation projects.

• Dormant privileged access rate. Privileged entitlements not used in 90 days, divided by total privileged entitlements. Target: under 3%.
• Orphaned account rate. Active accounts with no assigned owner or manager, divided by total active accounts. Target: zero. Every orphaned account is a finding waiting to happen.
• Segregation of duties (SoD) conflict count. Users holding entitlements that together violate an SoD rule (approve and pay, develop and deploy to prod, etc.). Target: zero unremediated. Any non-zero requires a compensating control and documentation.
• Standing privileged access rate. Privileged entitlements granted permanently rather than time-bound through just-in-time elevation. Target: falling every cycle. Best-in-class programs have under 20% of privileged access standing.

These four are the risk metrics an auditor or a red team lead cares about most.

Which metrics predict audit posture?

Four metrics. These roll up to the audit committee.

MTTR is the load-bearing metric of the four. Every other audit posture metric can look good with a broken MTTR, but a broken MTTR guarantees an audit finding.

What target ranges signal a healthy program?

Consolidated view. Snapshot this each quarter.

• Campaign duration: 10 business days.
• Reviewer completion at cutoff: above 95%.
• Escalation rate: 10 to 20%.
• Revocation execution rate: above 95%.
• Dormant privileged access: under 3%.
• Orphaned account rate: zero.
• SoD conflicts unremediated: zero.
• Standing privileged access: trending down, under 20% for best-in-class.
• Access-related audit findings: zero.
• Evidence completeness: 100%.
• Mean time to revoke: under 5 business days.
• Control coverage: 100% of in-scope systems.

You will not hit all twelve targets in year one. You should be moving toward every one of them by year two.

Which metrics drive the fastest behavior change?

Two metrics move behavior faster than any others.

• Reviewer completion rate, published by manager. When a manager sees their team's completion rate next to the other teams' rates, completion changes within one cycle. Do not overthink the incentive structure; visibility is the incentive.
• Dormant privileged access, published by system owner. When the AWS account owner sees "you have 27 dormant admin entitlements", they start requesting revocations rather than resisting them. The metric shifts them from defense to cleanup.

Every other metric matters, but these two are the ones that shift the culture. Publish them monthly, not quarterly.

How do you handle metric gaming?

Every metric can be gamed. Two show up first.

• Reviewer completion rate gets gamed by bulk approve. Countermeasure: pair completion with revocation rate cycle-over-cycle. A reviewer with 100% completion and 0% revocations two cycles running is rubber-stamping. Flag the pattern, not the reviewer.
• MTTR gets gamed by marking tickets closed before the access is actually gone. Countermeasure: validate revocation state in the source system, not in the ticket queue. If the ticket says closed and the access is still live, the ticket is not closed for MTTR purposes.

A metric that cannot be validated against the actual state of the system will be gamed. Build validation into every metric that matters.

What is the reporting cadence for these metrics?

Three cadences.

• Weekly. Campaign duration and reviewer completion rate during an active campaign. Consumed by the campaign owner and the CISO.
• Monthly. Reviewer completion rate by manager, dormant privileged access by system owner, MTTR by system. Consumed by managers and system owners.
• Quarterly. All twelve metrics, trended. Consumed by the audit committee and the security leadership.

Cadence matters as much as the metrics. A metric read once a year is not an operating metric.

The mistake to avoid

Most CISOs pick five metrics that are easy to measure and ignore the seven that matter. Campaign duration and reviewer completion rate are easy to measure. Dormant privileged access, orphaned accounts, and mean time to revoke require pulling data from the source systems and validating state, which is harder. But it is the harder metrics that predict breach exposure and audit findings. If your dashboard only tells you whether the campaign closed, you have a paperwork metric, not a security metric. Add the risk metrics before the audit committee asks why you did not.