Certification

The Certification object drives access reviews. A certification is a campaign in which designated reviewers look at the access their people or resources hold and explicitly attest that each item is still appropriate, revoking what is not. Certifications are the single most important source of compliance evidence in SailPoint.

• A campaign is generated against a defined population (a manager’s reports, an application’s users, a set of roles).
• Each reviewer receives work items listing the access to review.
• The reviewer approves (access is still needed) or revokes (access should be removed) each item, with comments.
• Revocations feed the provisioning engine to actually remove the access.
• Every decision is recorded, that record is the audit evidence.

• Manager certifications: a manager reviews their team’s access.
• Application/entitlement owner certifications: an owner reviews who holds their application’s access.
• Role membership certifications: review who is in a role.
• Targeted / event-based micro-certifications: triggered by a risky change, far more effective than annual sweeps.

The enemy of certification is rubber-stamping. Give reviewers context, plain-language entitlement descriptions, risk and outlier flags, and scope campaigns so the volume is reviewable. A reviewer faced with 800 cryptic items will approve all; one shown 40 items with clear descriptions and outliers highlighted makes real decisions.

• Oversized campaigns causing rubber-stamping and generation performance problems.
• Undescribed entitlements reviewers cannot judge.
• Revocations that never provision, decisions recorded but access not actually removed.