| name | performing-access-review-and-certification |
| description | Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based p |
| domain | cybersecurity |
| subdomain | identity-access-management |
| tags | ["iam","identity","access-control","access-review","certification","compliance","governance"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"] |
Performing Access Review and Certification
Overview
Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based prioritization, micro-certification strategies, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS requirements.
When to Use
- When conducting security assessments that involve performing access review and certification
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Coverage Gaps & Validation
- Rubber-stamping: reviewers approving every item without reading it is the top reason reviews miss bad access. Track per-item decision time and bulk-approve rates; near-100% certify with zero revokes is a red flag, not a clean environment.
- Incomplete application scope: the campaign only covers apps feeding the IGA tool. Shadow SaaS, apps integrated for SSO but not provisioning, local/break-glass accounts, and direct database logins get silently excluded.
- Non-human identities missed: service accounts, API tokens, and shared accounts frequently have no manager and fall out of manager-based campaigns entirely.
- Indirect entitlements: access granted via nested groups, roles, or policy inheritance displays differently (or not at all) than direct grants, so reviewers under-see effective access.
- Shadow admin: privilege held through API tokens, OAuth grants, or app-local admin roles rarely surfaces in a standard user-access review.
- Validate completeness: reconcile reviewed entitlements against an authoritative source — HR feed for population, AD/IdP for accounts, each application's native privilege export — and confirm every revocation was actually removed in the target system, not just recorded on paper.
Prerequisites
- Familiarity with identity access management concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Design and execute access review campaigns across enterprise applications
- Implement risk-based prioritization for review scope
- Configure reviewer selection (manager, application owner, hybrid)
- Automate entitlement data collection and presentation
- Track remediation of inappropriate access findings
