Access certification (access review) asks accountable owners to confirm that each entitlement is still justified. Campaigns can be periodic (quarterly SOX) or continuous (risk-triggered).
Good campaign design:
- Scope by risk — critical apps and privileged roles first.
- Give reviewers context: job title, last used, peer comparison, SoD hits.
- Force a decision: Keep or Revoke (with optional comments).
- Auto-remind and escalate stale items; never leave “no response” as silent keep.
- Export evidence: who decided, when, and what changed in target systems.
Common revoke signals: unused high-risk access, ended contractors, role changes, standing admin that should be JIT.
Practice below with a mini Certification Campaign.