Access rights are formally reviewed periodically to confirm they remain appropriate
Committing to a periodic access review is how A.5.15's access-based-on-need principle stays true over time, instead of only being checked the day an account is created.
Committing in writing to a periodic access review, naming who reviews and the removal deadline, supports A.5.18's review step, though provisioning and revocation are covered by other Sekit controls.