Access review and certification

Access review and certification lets you check, at regular intervals, that each user still needs the access they have in Segura™. You run the review as a campaign. Each campaign has a start date, a duration, and a set of users to review. Reviewers check each user's roles and access policies, and remove what the user no longer needs.

You manage campaigns in Settings > Access control > Users review and certification.

Key concepts

Who does what

• By default, PAM Administrator and System Administrator users create and manage campaigns.
• System Administrator users set the reviewer of each user and user group.
• Reviewers need the Access review and certification role to open the review screen. Being selected as a reviewer does not grant this role. The role only reviews. It cannot create or manage campaigns.
• User Management global approvers review users who have no reviewer. When the approval workflow is enabled, they also approve completed reviews.

Reviewers

Each user can have a direct reviewer, set on the user record, and one group reviewer for each user group they belong to. These reviewers add up, and any one of them can review the user. The first reviewer to finish completes the review for everyone. Users with no reviewer go to the global approver.

When a reviewer is deactivated, their users pass to that reviewer's own reviewer. If the deactivated reviewer has no reviewer, the global approver reviews those users. The same rule applies to a deactivated group reviewer. For the full model, see Reviewers and global approvers.

Global approver prerequisite

Every campaign needs at least one global approver for the User Management module, as a fallback reviewer. Segura™ refuses to create a campaign without one.

When you create or edit a campaign, the Global approvers grid shows the User Management global approvers, and you can add or remove them there. The grid is read-only while the campaign is Enabled, Scheduled, or Processing.

While a campaign is Enabled, Scheduled, or Processing, Segura™ refuses to remove the last User Management global approver. For details, see Manage approvers.

How a campaign works

Scope

A campaign reviews one of the following:

• All active users. This is the default.
• Specific users that you select.
• The members of specific user groups that you select.

You can change the scope while the campaign is scheduled. When the campaign starts, Segura™ freezes the list of users. Users created or added to a group after the start are not included. A recurring campaign reviews the same list again in each cycle.

Review

Each reviewer sees the users they review. They can remove roles and access policies that the user no longer needs, and they record a justification. Only access policies assigned directly to the user can be removed. Policies the user inherits from user groups appear in the review, but cannot be removed there. Reviewers cannot open, save, or view the review history of users they do not review.

To see the reviews of all users, use the Users review and certification report in Reports > Review and certification. By default, System Administrator, PAM Administrator, System Auditor, and PAM Auditor users can open it. The review history on the review screen shows only the users you review, while a campaign is active.

Approval workflow

One reviewer is enough to complete a user's review. If Enable approval workflow for users review and certification is turned on in Settings > System Parameters > Global > Approval Flow, each completed review then goes to approval. The global approver of the User Management module approves it before the changes take effect. For the steps, see How to approve a user review.

By default, a global approver cannot review or approve their own access. The Allow global approvers to review and approve their own access parameter, on the same screen, allows it. For both parameters, see System Parameters - Approval Workflow.

Deadline and escalation

You can enable escalation. When a reviewer does not complete a review on time, escalation passes it to that reviewer's own reviewer, and so on, up to the global approver.

Segura™ does not remove any access automatically at the end date.

Paused campaigns

Segura™ lets you deactivate or delete the last User Management global approver, so that the person loses access at once. A job then checks every hour for campaigns left without a global approver. It moves each Enabled, Scheduled, or Processing campaign it finds to the Paused status. Campaign details show the reason and the date of the pause.

A paused campaign stays paused until a PAM Administrator or System Administrator resumes it. To resume, register a new User Management global approver, and then use Resume campaign in the campaign list. Segura™ refuses to resume while there is still no active global approver. The campaign returns to the status it had before the pause.

Paused time does not count toward escalation, and the end date moves forward by the same amount. Campaigns that have already ended never pause.

Notifications

Segura™ sends these notifications during a campaign:

• The reviewers of the users in scope are notified when the campaign starts and when the deadline approaches.
• When the approval workflow is enabled, the User Management global approvers are notified when a review needs approval.
• Each reviewed user gets an e-mail when their review is complete.
• When a campaign is paused, all PAM Administrator and System Administrator users get a notification in the notification center and by e-mail.

Segura™ does not notify a reviewer when they are assigned to a user. For the texts of these notifications, see Notification texts.

Audit

Segura™ records campaign activity in Reports > Audit. The audit trail includes:

• Changes to the reviewer of a user or a user group, including the number of users affected by a group change.
• Changes in Manage global approvers.
• Each pause and each attempt to resume a campaign, with who acted and why.
• Each user review that is concluded, sent for approval, approved, or rejected, recorded on the reviewed user, with the access removed or proposed for removal.

When to use it

• To review privileged access periodically, as required by security standards such as ISO 27001 and PCI DSS.
• To remove roles and access policies that users no longer need.
• To keep an auditable record of who reviewed what, and when.

Related topics

• Reviewers and global approvers.
• Create a user review campaign.
• Review a user's access.
• How to approve a user review.
• Campaign.
• Users by reviewer.
• Manage approvers.
• Access review campaign problems.