Access rights review:
how do you ensure the compliance of your users’ information system authorisations?

Which best practices should be followed
for effective rights review campaigns?

To ensure that rights reviews are genuinely effective, one challenge is to involve functional managers: they must be able to evaluate simply whether their teams’ authorisations are legitimate and justified.

This entails, at least:

1. Determining a relevant and reasonable scope for the review: which user populations, which applications, which business managers, etc.
2. Raising awareness, and providing tools, training and support for the business managers involved in the review campaign
3. Industrialising the authorisation review by harnessing the right tools and a precise methodology

In fact, while an access rights review is a highly operational identity and access control and governance process, it is essential to link it closely to your identity and access management platform. The latter must be capable of organising recertification campaigns, in which all stakeholders will be involved according to remit, and it must have great functional richness:

• Advanced configuration of rights review campaigns (duration, frequency, targeted resource and populations, campaign administrators and approvers, etc.),
• Capacity to carry out preliminary simulations of rights to be recertified in order to anticipate how anomalies will be handled,
• Option to harness notification and approval workflow processes so that the people affected by the campaign can validate or reject the authorisations they are responsible for,
• Capacity to perform operations including the recalculation of the rights model if necessary and the remediation of any anomalies observed, including by implementing automated provisioning operations,
• Provision of detailed reports on rights review campaigns and tracking of the progress of campaigns, the percentage of rights reviewed, statistics, etc.