Certain sections of IS-3 and IS-11 require us to audit account access and ensure that users still need to have access to the resources.

The way we have currently chosen to comply with this is to have the users periodically re-acknowledge the terms of service. The frequency depends on the data classification level.

About a week prior to the renewal date the individual users will receive an email every day asking them to follow the link and acknowledge the TOS. They will receive this email daily until they do.

Once the date has passed the account owner will receive the notice that the accounts have expired. 

At this point the notice is also sent to the CloudOps team to terminate access for the user.

This team will reach out proactively to the users and the account owners and give them the opportunity to comply in case they did not understand the notifications or if they went into their spam folders.

However, if the user does not acknowledge they TOS they will have their account access suspended until it is re-authorized by the account owner.