Periodic Access Review and Certification
Periodically confirming that access is still valid
Periodic access review and certification is the process through which the owners of each system or area formally confirm, at regular intervals, that the permissions granted to each user are still necessary and appropriate, instead of assuming that access granted long ago still has a business justification. This matters in practice because permissions tend to accumulate silently over time as people change projects or roles without anyone revoking what they no longer use, and without a formal certification process that accumulation is only discovered, if at all, during an external audit or after an incident. A concrete example is a quarterly certification campaign where each manager receives a list of their team's access to sensitive systems and must explicitly approve or revoke each one, an exercise that often reveals access inherited from projects that ended months ago that nobody had thought to remove.