performing-access-review-and-certification

name	performing-access-review-and-certification
description	Designs and runs access review and certification campaigns-scoping, reviewer selection, risk-based prioritization, micro-certification, and remediation tracking-to verify user access matches job roles for SOX, HIPAA, and PCI DSS compliance. Use when planning or executing periodic access recertification or preparing evidence for an IAM compliance audit.
domain	cybersecurity
subdomain	identity-access-management
tags	["iam","identity","access-control","access-review","certification","compliance","governance"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]
mitre_attack	["T1078","T1110","T1556","T1098"]

Performing Access Review and Certification

Overview

Conduct systematic access reviews and certifications to ensure users have appropriate access rights aligned with their roles. This skill covers review campaign design, reviewer selection, risk-based prioritization, micro-certification strategies, and remediation tracking for compliance with SOX, HIPAA, and PCI DSS requirements.

When to Use

• When conducting security assessments that involve performing access review and certification
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with identity access management concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Design and execute access review campaigns across enterprise applications
• Implement risk-based prioritization for review scope
• Configure reviewer selection (manager, application owner, hybrid)
• Automate entitlement data collection and presentation
• Track remediation of inappropriate access findings
• Generate compliance evidence for auditors

Key Concepts

Access Review Types

1. User Access Review: Manager certifies all entitlements for their direct reports
2. Entitlement Review: Application owner certifies all users with specific entitlement
3. Role Review: Role owner certifies role membership and permissions
4. Privileged Access Review: Security team reviews high-risk/privileged access
5. SOD Review: Verify no users have conflicting separation-of-duty violations

Risk-Based Prioritization

• High Risk: Privileged access, financial systems, PII/PHI systems, external-facing apps
• Medium Risk: Internal business applications, shared drives, collaboration tools
• Low Risk: Standard employee tools, read-only access, public information systems

Review Campaign Lifecycle

1. Planning: Define scope, reviewers, timeline, escalation
2. Data Collection: Aggregate entitlements from all identity sources