Traceability, audit and compliance

Organizations need to show how identities, entitlements and access decisions have been handled over time. Traceability, audit and compliance are about creating traceability, decision evidence and history that can be used for internal control, external reviews and follow-up.

Use case

Organizations need to show who had access to systems and resources, who approved the access and which changes have been made over time.

This is often required by internal auditors, external reviewers, security functions and regulatory frameworks.

Organizations therefore need to follow up both decisions and actual changes. This can include ensuring that:

• access decisions can be traced to responsible people
• changes are documented and can be followed up afterward
• history around identities, entitlements and responsibility relationships is preserved
• audits and reviews can be performed efficiently
• internal policies and external requirements can be verified

Common questions during audits and follow-up include:

• Who had access to a specific resource at a given point in time?
• Who approved the access?
• When was the entitlement granted or revoked?
• Which changes have been made over time?
• Which controls have been performed and by whom?

The result is better traceability, more efficient reviews and clearer evidence for showing compliance with internal and external requirements.

How Fortified ID supports this

Fortified ID Control can provide evidence for audits and follow-up of identities, entitlements, attestations, certifications and lifecycle events. Reporting and Auditing can collect history around decisions, changes and performed controls.

Forms can provide traceability around how flows have been used, which changes were made, which users or resources were affected and who initiated or performed the action. History can be followed from a flow, an object or a user to understand what changed, by whom and when.

Schedules can initiate recurring controls, certifications and reporting so follow-up happens regularly rather than only before an audit.

Fortified ID Access can contribute traceability around login events and access to connected resources. This can provide evidence showing who authenticated, which resource was used and when access occurred.

Fortified ID Password Reset can contribute history around password resets. It can show when a reset was performed, which account was affected and who performed the action when the reset was done for another user.

Examples

• Following up who had access to a specific resource at a given point in time
• Reviewing who requested, approved, changed or revoked entitlements
• Evidence for internal control, audits and external reviews
• History around attestations, certifications and lifecycle events
• Traceability around logins and access to connected resources
• Follow-up of password resets and administrative actions