Short answer: Level 1 asks you to know exactly who can sign in to company systems.
- A list: everyone who can sign in, each tied to a named person.
- One account per person: every sign-in traces to an individual.
- Only those people get in: leavers are blocked and unknown accounts are removed.
What the rule asks
Two practices cover people, with three checks between them:
| Practice | The assessor checks that… |
|---|---|
| AC.L1-b.1.i | the people allowed to use your systems are identified |
| AC.L1-b.1.i | access is limited to those people |
| IA.L1-b.1.v | each person who uses your systems is identified |
What good looks like
- A current list of every account that can sign in, each matched to a named person who works for you, or to a purpose you can explain.
- One named account per person, in one consistent format, such as first.last@yourcompany.com.
- No account left active for someone who has left.
- A shared login, if you still have one, listed as its own entry with everyone who uses it named. Level 1 expects each person to sign in as themselves, so plan to replace it (see the guide on signing in).
How to do it in Microsoft 365
- Export the list. In the Microsoft 365 admin center (admin.microsoft.com), go to Users → Active users and choose Export users to download every account as a CSV file.
- Check each account. Confirm that each one belongs to a current employee or has a purpose you can explain. Follow up on any account you cannot place.
- Block leavers. For anyone who has left, select the account and choose Block sign-in before you delete it.
- Remove unknown guests. In Microsoft Entra (entra.microsoft.com), go to Identity → Users, filter by user type Guest, and remove guests you do not recognize.
In Google Workspace, the same list is in the Admin console under Directory → Users, where you can suspend the accounts of people who have left.
What proof to keep
- The exported user list, with each account matched to a person or a purpose.
- The date of your last review, and who did it.
- A record of the accounts blocked or removed when people left.
Common mistakes
- An account still active for someone who left months ago.
- A shared "office" login whose password several people know, and that nobody has listed.
- Guest accounts from old projects that nobody recognizes.
- Test or temporary accounts that were never removed.
Do it step by step
The User accounts task in ReComply builds this list with you: type the people in, or upload the list you already have. It is one of the three tasks open on the Free plan.
Start free