What is recertification?
Recertification is the process of continually auditing permissions to make sure the access provided is only the access that is needed. Recertification streamlines and automates the process of revalidating a target type (account or access) or membership (role or resource group) on a regular basis. Access recertification is an information technology control that includes reviewing user access rights to see if they are proper and comply with the company's internal rules and laws.Â
For its apps, databases, and other resource access, the organization has a periodic recertification procedure in place. As a result of recertification, a manager or responsible party, or system owner certifies users' access to a system to guarantee that they only have access to what they require.
Recertification is a part of an organization’s governance risk and compliance activity. Recertification or attestation are different terms for the same thing. GRC (governance, risk, and compliance) is a collection of rules and procedures that enable firms to achieve their business goals, deal with uncertainty, and behave with integrity. The goal of the recertification is to present the system data to the auditors and to ensure that there are no nonconformity findings during audits.
Why recertification is needed?
The implementation of a recertification procedure can safeguard a corporation from potential security breaches and fines.
To guarantee that only authorized personnel has access to the enterprise's data, owners of key business data must verify that all application and database user entitlements and privileges are recertified on a regular basis. With access recertification, it's assured that no users have access to resources that aren't assigned to them.
Depending upon the size of the company and whether they are public or non-pubic, and the industry they are in, such as banking or finance, etc., many companies are required by law to perform recertification or attestation of access. A company would like to have risk management in place to prevent people from getting toxic combinations of access that could be a risk to the company. For example, a person might get access to create a purchase order as well as access to approve the same purchase order. This is a toxic combination of access and is a potential risk for a company.
Therefore, to minimize the risk, for all the risky accesses, we should be able to certify and recertify on a regular basis that the access is still needed. For example, is this user account still needed? if a user has already resigned from the company, the user account should not be active. These kinds of potential risks are checked and minimized with the help of recertification at regular intervals.
What is a recertification audit?
The review of user access rights to see if they are proper and correspond to the organization's internal rules and compliance standards is known as access recertification audit. The recertification is often implemented as an audit.
An audit can be considered as a project with a start date and end date. We might want to audit or certify multiple items using an audit. For example, in a Q1 audit we might want to certify, an external partner, identify as well as a member of certain high-risk management roles. These items are specified in one or more recertification policies. EmpowerID maintains an audit trail of these access snapshots and the decisions made concerning the access. EmpowerID recertification audits can be scheduled to run periodically, such as on a quarterly or monthly basis, weekly, daily, or at will.
What is the recertification policy?
A recertification policy contains actions to ensure that users submit assurance that they have a genuine, continuous need for a particular resource or membership. As a project might have multiple deliverables a recertification audit can have multiple recertification policies associated with it. We can create recertification policies of different types in the EmpowerID system, and these policies are reusable. For example, in an audit we might want to certify, an external partner, identify as well as a member of certain high-risk management roles. These items are specified in one or more recertification policies.
Recertification Policies are snapshots of data that reveal the access to resources granted to people and to roles, the assignments of people to roles, and the security assignments that have been made against protected resources like Exchange mailboxes, applications, and groups. These snapshots are routed for review to authorized personnel such as managers, role owners, or data owners. The review process allows the reviewer to verify the access and certify whether it is valid. Internal processes can use this data to remediate and rectify exceptions or certify the exceptions as permitted.
EmpowerID provides a collection of useful recertification policy types.
Recertification in EmpowerID
EmpowerID provides a powerful attestation and recertification platform that gives any organization the ability to take a more proactive approach to rectify potential security issues before they occur through crafting EmpowerID audits and recertification policies. The combination of Recertification Policies with EmpowerID's robust reporting capabilities allows organizations to create a more thorough and effective resource management strategy.
The primary building blocks of recertification in is depicted in the below image.
For recertification to work in EmpowerID following steps are needed.
To maintain the integrity of recertification reviews, users cannot recertify themselves. In other words, a user who can create a recertification policy cannot certify that policy. The EmpowerID admin user is prohibited from participating in the review process by this feature.