Access certification

Entitlements change over time. Access certification helps the organization periodically verify that users, groups, roles and responsibility relationships are still correct and justified.

Use case

Over time, users often accumulate more access than they need. Role changes, projects, temporary assignments and organizational changes can leave access in place even when the need no longer exists.

Responsibility relationships also change within the organization. Managers change, consultants finish assignments and organizational changes can leave users connected to the wrong manager, sponsor or responsible person.

Organizations therefore need to regularly verify both entitlements and responsibility relationships. This can include reviewing whether:

• the user should still have the entitlements
• the user should still be a member of the current groups and roles
• the user still belongs to the correct manager, sponsor or responsible person
• external users and consultants still have a valid assignment
• entitlements still follow business needs, policies and risk levels

The result is better control over excessive access, clearer responsibility and better evidence for audits and internal follow-up.

How Fortified ID supports this

Fortified ID Control can be used to initiate and perform recurring certifications. Schedules can start reviews at selected intervals, while Forms can give managers, resource owners, sponsors and other responsible people a structured view for attestation.

Approval Flows can control what should happen after a certification decision, such as removing entitlements, updating responsibility relationships or handling deviations. Reporting and Auditing can provide evidence for following up certification decisions, attestations and completed changes.

Fortified ID Access can complement the process when certification or attestation requires stronger identity verification. Strong authentication can increase security around sensitive review decisions.

Examples

• Recurring review of user entitlements
• Certification of group and role memberships
• Verification of manager, sponsor or other responsible person
• Follow-up of external users, consultants and partners
• Identifying users who have not logged in for a certain period, for example 90 days
• Handling entitlements that should be removed or changed after review
• Evidence for audits, internal control and compliance