performing-access-recertification-with-saviynt

name	performing-access-recertification-with-saviynt
description	Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC 2, and HIPAA. Use when launching or managing certification campaigns for users/entitlements, remediating access review findings, or documenting identity governance evidence for an audit.
domain	cybersecurity
subdomain	identity-access-management
tags	["saviynt","access-recertification","identity-governance","compliance","certification-campaign","iga"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AA-01","PR.AA-02","PR.AA-05","PR.AA-06"]
mitre_attack	["T1078","T1110","T1556","T1098","T1071"]
mitre_f3	{"version":"1.1","tactics":["initial-access","positioning","defense-impairment","resource-development"],"techniques":[{"id":"T1586","name":"Compromise Accounts","tactic":"resource-development","source":"attack"},{"id":"F1033","name":"Insider Access Abuse","tactic":"initial-access","source":"f3"},{"id":"F1005","name":"Account Manipulation","tactic":"positioning","source":"f3"},{"id":"F1005.002","name":"Account Manipulation: Add Authorized User","tactic":"positioning","source":"f3"},{"id":"F1005.007","name":"Account Manipulation: Enable Account Features","tactic":"defense-impairment","source":"f3"}]}

Performing Access Recertification with Saviynt

Overview

Access recertification (also called access certification or access review) is a periodic process where designated reviewers validate that users have appropriate access to systems and data. Saviynt Enterprise Identity Cloud (EIC) automates this process through certification campaigns that present reviewers with current access assignments and collect approve/revoke/conditionally-certify decisions. Campaigns can be triggered on schedule (quarterly, semi-annually), event-driven (department transfer, role change), or on-demand. Saviynt provides intelligence features including risk scoring, usage analytics, and peer-group analysis to help reviewers make informed decisions.

When to Use

• When conducting security assessments that involve performing access recertification with saviynt
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Saviynt Enterprise Identity Cloud (EIC) tenant with admin access
• Identity data synchronized from authoritative sources (HR, AD, cloud)
• Entitlement data imported from target applications
• Certifier roles assigned (managers, application owners, data owners)
• Campaign templates defined for each certification type

Core Concepts

Campaign Types

Type	Scope	Trigger	Certifier
User Manager	All access for users under a manager	Scheduled (quarterly)	Direct manager
Entitlement Owner	All users with a specific entitlement	Scheduled (semi-annually)	Entitlement/app owner
Application	All access to a specific application	Scheduled	Application owner
Role-Based	All users assigned to a specific role	Scheduled	Role owner
Event-Based	Users whose attributes changed	Attribute change trigger	New manager
Micro-Certification	Single user, single entitlement	On-demand	Manager or owner

Certification Decisions