Chief among these are that access rights should be reviewed in conjunction with business managers at some regular interval (quarterly or monthly, depending on your risk disposition), anytime someone undergoes a significant role transfer within a firm, and most importantly when someone leaves a firm.
Your main changeable setting is the interval between auto-refreshes and, naturally, a subscription is required for enhanced access to the NYT's content.