Identity Governance

Step 1: Define scope
  → Which systems, applications, and users are in scope?
  → "All employees with access to the financial system"

Step 2: Collect data
  → Export current access rights from each system
  → Generate certification report for each reviewer

Step 3: Distribute certifications
  → Managers receive list of their team's access
  → Each access right must be: Certified (approved) or Revoked

Step 4: Review and remediate
  → Certified access: remains in place until next campaign
  → Revoked access: automatically removed after campaign closes
  → Unreviewed access: automatically revoked after campaign deadline (HARD CUTOFF)

Step 5: Report and audit
  → Campaign completion report to compliance team
  → Evidence for auditors (SOX, SOC 2, PCI, HIPAA)
  → Metrics: certification rate, revoked access count, overdue items

ACCESS CERTIFICATION — FINANCIAL SYSTEMS
Campaign ID: CERT-2026-Q1-FINANCE
Period: January 1 — March 31, 2026
Reviewer: Sarah Chen (Finance Director)

| User | System | Access Level | Last Used | Risk | Decision |
|------|--------|-------------|-----------|------|----------|
| Alice Wang | ERP | Finance Manager | Today | High | □ Certify  □ Revoke |
| Bob Smith | ERP | Accounts Payable | 3 days ago | Medium | □ Certify  □ Revoke |
| Carol Lee | ERP | Read Only | 60 days ago | Low | □ Certify  □ Revoke |
| David Kim | ERP | Full Admin | Yesterday | Critical | □ Certify  □ Revoke |

Rules:
- Privileged access not reviewed → auto-revoked after 14 days
- Access not used in 90+ days → flagged for removal recommendation
- SoD violations → flagged before certification can be completed

POLICY: "A user cannot be both a Purchase Order Creator AND a Goods Receiver"

Implementation:
  → Role "PO Creator" and Role "Goods Receiver" are marked as SoD-conflicting
  → If a user has both roles → provisioning system blocks
  → If both roles are business-necessary → compensating controls required:
      - Manager must approve exception (documented)
      - All transactions by this user are audited monthly
      - Access is reviewed quarterly (not annually)

-- Find users with similar access patterns (candidates for role-based grouping)
SELECT u.department, COUNT(DISTINCT a.application) as app_count,
       AVG(a.privilege_level) as avg_privilege
FROM users u
JOIN access_assignments a ON u.id = a.user_id
GROUP BY u.department, u.job_title
HAVING COUNT(DISTINCT u.id) > 3
ORDER BY app_count DESC;

Campaign Types:
  └─ User Access Review (UAR): Managers review their team's access
    └─ Frequency: Quarterly for privileged, annually for standard
    └─ Reviewers: Direct manager or resource owner
    └─ Scope: All application and system access

  └─ Role Entitlement Review: Review permissions assigned to each role
    └─ Frequency: Annually
    └─ Reviewers: Role owner (usually department head)
    └─ Scope: All permissions associated with each role

  └─ SoD Policy Review: Verify SoD rules are still appropriate
    └─ Frequency: Annually
    └─ Reviewers: Compliance team, internal audit
    └─ Scope: All defined SoD rules and conflict matrices

Campaign Process:
  1. Define scope: Which users, applications, roles are included?
  2. Assign reviewers: Who is accountable for certifying each access item?
  3. Notify reviewers: Email with deadline, link to certification portal
  4. Review period: 2-4 weeks for reviewers to certify/reject/revoke
  5. Escalation: Reminders at 2 weeks, 1 week, 3 days before deadline
  6. Auto-revoke: Unreviewed items are automatically revoked after deadline
  7. Remediation: Execute revocations, update policies
  8. Report: Generate compliance evidence report

Best Practices:
  └─ Make it easy for reviewers:
    └─ Show last access date (when did the user last use this access?)
    └─ Show manager + peer comparison (do similar users have similar access?)
    └─ Provide bulk certify (certify all items in one click)
    └─ Keep review sessions short (< 15 minutes per review session)

  └─ Automate the obvious:
    └─ Auto-certify: Users who haven't logged in for 90+ days → auto-revoke
    └─ Auto-certify: Managers who re-certify the same access 3+ times without changes
    └─ Auto-remediate: Orphan accounts → auto-disable

  └─ Escalation rules:
    └─ Reviewer inactive after 2 weeks → escalate to reviewer's manager
    └─ Reviewer inactive after 3 weeks → escalate to compliance team
    └─ After review deadline → auto-revoke all uncertified access

-- Find users with excessive privileged access (SQL example)
SELECT
    u.display_name,
    u.department,
    COUNT(ug.group_id) as group_count,
    SUM(CASE WHEN g.is_privileged = 1 THEN 1 ELSE 0 END) as privileged_group_count
FROM users u
JOIN user_groups ug ON u.id = ug.user_id
JOIN groups g ON ug.group_id = g.id
WHERE u.is_active = 1
GROUP BY u.id
HAVING privileged_group_count > 3
ORDER BY privileged_group_count DESC;

# Detect stale accounts (Powershell for Active Directory)
Get-ADUser -Filter {Enabled -eq $true} -Properties LastLogonDate |
  Where-Object { $_.LastLogonDate -lt (Get-Date).AddDays(-90) } |
  Select-Object Name, SamAccountName, LastLogonDate |
  Export-Csv -Path stale_accounts.csv -NoTypeInformation

# Detect orphan accounts (users no longer in HR system)
# Requires HR feed integration (Workday, SAP, BambooHR)
Compare-Object -ReferenceObject $hr_users -DifferenceObject $ad_users |
  Where-Object { $_.SideIndicator -eq "=>" } |
  Select-Object -ExpandProperty InputObject |
  ForEach-Object { Disable-ADAccount -Identity $_ }