Certification
The Certification object: a campaign to review and attest access.
A Certification is a review campaign where reviewers attest whether each access is still appropriate, revoking what is not.
- What the Certification object represents
- Key attributes and relationships
- How it is created and maintained
- Where it appears in governance
The Certification object drives access reviews. A certification is a campaign in which designated reviewers look at the access their people or resources hold and explicitly attest that each item is still appropriate, revoking what is not. Certifications are the single most important source of compliance evidence in SailPoint.
How a certification works
- A campaign is generated against a defined population (a manager’s reports, an application’s users, a set of roles).
- Each reviewer receives work items listing the access to review.
- The reviewer approves (access is still needed) or revokes (access should be removed) each item, with comments.
- Revocations feed the provisioning engine to actually remove the access.
- Every decision is recorded, that record is the audit evidence.
Types of certification
- Manager certifications: a manager reviews their team’s access.
- Application/entitlement owner certifications: an owner reviews who holds their application’s access.
- Role membership certifications: review who is in a role.
- Targeted / event-based micro-certifications: triggered by a risky change, far more effective than annual sweeps.
Making certifications meaningful
The enemy of certification is rubber-stamping. Give reviewers context, plain-language entitlement descriptions, risk and outlier flags, and scope campaigns so the volume is reviewable. A reviewer faced with 800 cryptic items will approve all; one shown 40 items with clear descriptions and outliers highlighted makes real decisions.
Common pitfalls
- Oversized campaigns causing rubber-stamping and generation performance problems.
- Undescribed entitlements reviewers cannot judge.
- Revocations that never provision, decisions recorded but access not actually removed.