Browse Definitions :
Definition

access recertification

Access recertification is an IT control that involves auditing user access privileges to determine if they are correct and adhere to the organization’s internal policies and compliance regulations. Access recertification is typically the responsibility of the organization’s Chief Information Security Officer (CISO) or Chief Compliance Officer (CCO) and may also be known as access attestation or entitlements review.

Access recertification can be carried out manually or programmatically. The first step in a manual recertification process is to extract and collate account information from the organization’s IT and business systems and distribute it in a format that will allow each manager to easily see what privileges each of his or her employees has been granted. Managers are then given a deadline for reviewing the information to flag inappropriate access and verify appropriate access. Challenges with this approach include the possibility that recertification may only be carried out sporadically and that some managers may not understand the importance of access recertification and rubberstamp their verifications.

In large organizations, access governance software can be used to automate the recertification process and ensure that audits occur on a regular basis. Once the information has been extracted and normalized, the software uses a message template to issue recertification requests. If the recipient of the recertification request fails to respond within a specified time period, the software suspends the recipient’s access rights and notifies the recipient’s manager. Challenges with this approach include the cost of the software as well as the time, effort and technical knowledge it requires to ensure the software’s interoperability with legacy systems.

This was last updated in October 2016

Continue Reading About access recertification

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • compliance audit

    A compliance audit is a comprehensive review of an organization's adherence to regulatory guidelines.

  • regulatory compliance

    Regulatory compliance is an organization's adherence to laws, regulations, guidelines and specifications relevant to its business...

  • Whistleblower Protection Act

    The Whistleblower Protection Act of 1989 is a law that protects federal government employees in the United States from ...

SearchSecurity

  • RSA algorithm (Rivest-Shamir-Adleman)

    The RSA algorithm is the basis of a cryptosystem -- a suite of cryptographic algorithms that are used for specific security ...

  • remote access

    Remote access is the ability to access a computer or a network remotely through a network connection.

  • IP Spoofing

    IP spoofing is the crafting of Internet Protocol (IP) packets with a source IP address that has been modified to impersonate ...

SearchHealthIT

SearchDisasterRecovery

  • network disaster recovery plan

    A network disaster recovery plan is a set of procedures designed to prepare an organization to respond to an interruption of ...

  • virtual disaster recovery

    Virtual disaster recovery is a type of DR that typically involves replication and allows a user to fail over to virtualized ...

  • tabletop exercise (TTX)

    A tabletop exercise (TTX) is a disaster preparedness activity that takes participants through the process of dealing with a ...

SearchStorage

  • enterprise storage

    Enterprise storage is a centralized repository for business information that provides common data management, protection and data...

  • disk array

    A disk array, also called a storage array, is a data storage system used for block-based storage, file-based storage or object ...

  • optical storage

    Optical storage is any storage type in which data is written and read with a laser. Typically, data is written to optical media, ...

Close