What is a Certification Campaign?

What is a Certification Campaign?

In Identity Governance and Administration (IGA), a Certification Campaign refers to the systematic process that organizations use to ensure user access rights and permissions are accurate, appropriate, and aligned with business policies and compliance requirements across systems, applications, and data resources. The principal purpose of using Certification Campaigns is to regularly validate who has access to what resources and why. This enables an organization to prevent unauthorized access to sensitive assets, ensure compliance with regulatory requirements, reduce security risks, and maintain an audit trail for accountability purposes.

Key Features of Certification Campaigns

Access Review

The campaign typically involves managers, application owners, or compliance officers reviewing user access rights to ensure they are aligned with their job roles and responsibilities.

Automation

Modern IGA solutions automate the initiation, tracking, and reporting of Certification Campaigns. Campaigns can be triggered on a schedule (e.g., quarterly or annually) or in response to specific events (e.g., an employee leaving or changing roles).

Role-Based Access

The campaign checks whether users have the correct role-based access and identifies over-provisioning or unused privileges. Many organizations use Role-Based Access Control (RBAC), a method that restricts users’ access to resources based on the roles assigned to them within an organization. Rather than assigning permissions to individual users, permissions are grouped by role, and users are assigned to roles that determine what actions they can perform and which resources they can access within an IT infrastructure.

Compliance

Helps organizations comply with regulations such as Sarbanes-Oxley (SOX), General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and others by providing auditable access reviews.

Risk Mitigation

Identifies potential risks from excessive access or orphaned accounts (accounts that are active but no longer associated with any user).

End-to-End Visibility

Provides a detailed view of access across all systems, enabling informed decisions about approvals, revocations, or modifications.

Types of Certification Campaigns

Periodic Certification

Scheduled reviews (e.g., quarterly or annually) where managers validate user access rights.

Event-Driven Certification

Triggered by events such as an employee’s departure, role change, or a new regulatory requirement.

Targeted Certification

Focused on specific high-risk systems, users, or roles.

Manager Certification

Managers review and certify the access rights of their direct reports.

Application Owner Certification

Application or data owners validate who has access to their resources and ensure appropriateness.

How a Certification Campaign Typically Works

Initiation

An administrator defines the purpose of the campaign including what data is to be certified, who should certify it, and how often the survey should run in the IGA system. The administrator also inputs what should happen when responses are submitted or when answers are not given as well as the notifications and reminders that should be sent and determines who can monitor and manage the campaign. Once the administrator has set up the campaign, a test can be run in the IGA system and, if necessary, perform any modifications.

Administration

A survey administrator initiates and assigns surveys to relevant managers or system owners. Administration includes determining when the survey should start, monitoring the progress, reassigning questions if requested to do so by the respondent, generating and sending reports to stakeholders, and closing the survey.

Response Phase

After a campaign has been initiated by the survey administrator, all the questions are assigned to individuals, so responses can be given. Questions that cannot be assigned automatically are manually assigned by the survey administrator. A task is sent to the responder, so they can answer the campaign questions.

Review and Action

Reviewers approve, revoke, or request changes to access rights. If a reviewing manager determines that access rights are not appropriate, then they should be removed from the user to maintain high levels of security and governance. When an employee or contractor leaves the organization and their identity is deleted, the organization must transfer the ownership of objects to another human identity. This process automatically starts a workflow, which allows resource owners to propose new owners, who can then accept or reject the proposal.

Ownership and Remediation

To ensure compliance, all accounts have an owner assigned to them. The account ownership process allows for both the manual proposing of new owners for the orphaned account and for the start of deprovisioning activities in cases where the orphaned account is no longer required, because the owner has left the organization. If the rules in the IGA system cannot identify an owner from an orphaned account, then a new owner must be assigned manually. Once the process is complete, the orphaned accounts will either have new owners or will be deleted.

Completion and Audit

The campaign results are documented and stored for auditing and compliance purposes. Audit trail functionality provides accountability by enabling auditors to gain insight into why access exists, who authorized it, and how that access originated.

Benefits of Certification Campaigns

Enhanced Security

Reduces the risk of insider threats or data breaches by ensuring access rights are limited to what’s necessary.

Regulatory Compliance

Simplifies audits and ensures adherence to laws and standards.

Operational Efficiency

Automates repetitive tasks and reduces manual errors.

Improved Accountability

Ensures clear ownership and responsibility for access decisions.

Where to Learn More and Get Help

To ensure ongoing security and compliance, it is necessary for organizations to regularly verify that information such as access rights, policies, role definitions, and master data held in an IGA system is still valid.

To succeed, the Certification Campaign process that an organization uses must be as simple and efficient as possible, so other stakeholders do not see it as an unnecessary obstacle to business workflows.

Omada has developed and defined best practices for creating a Certification Campaign process in IdentityPROCESS+. Following IdentityPROCESS+ enables organizations to create effective Certification Campaigns that ensure access rights are aligned with business policies and compliance requirements and do not violate any security and compliance policies. Learn more.