What do security teams get wrong about access recertification during ransomware defence programmes?

Teams often treat recertification as a paperwork exercise instead of a control that surfaces risky access. When done well, it confirms that access is still warranted, exposes improper permissions, and gives security teams evidence to disconnect affected systems quickly. If the process is inconsistent or ignored, risky access stays in place and response decisions become slower and less precise.

Why access recertification fails during ransomware defence programmes

Recertification fails when it is treated as an annual compliance ritual instead of a live control over who can still reach critical systems. In a ransomware context, the question is not just whether access was once approved, but whether it is still justified, still observable, and still removable fast enough to limit blast radius.

The practical mistake is assuming that a signed-off review is proof of safety. If reviewers lack context, inherited access, stale entitlements, and hidden third-party or non-human accounts tend to survive untouched, which is why recertification must be tied to incident response, not parked beside it.

When the review process does work, it becomes a discovery mechanism for stale privileges, orphaned access, and permissions that no longer match the current business role. That makes it valuable during a ransomware programme because it turns “who should still have access?” into an evidence-backed operational decision rather than a documentation exercise.

What good recertification looks like when ransomware is the concern

Effective recertification is targeted, time-bound, and tied to the systems that matter most to containment. High-risk access should be reviewed first, especially where privileged accounts, shared accounts, remote access paths, or service credentials could accelerate lateral movement or restore attacker access after remediation.

The best reviews do more than confirm access. They identify whether access is still needed for the current task, whether the owner can justify it, and whether the access can be reduced, segmented, or revoked without breaking recovery operations. For broader IAM context, IAM and IGA Basics is useful for understanding how access reviews fit into governance rather than being treated as a one-off administrative task.

Recertification also needs to distinguish between normal business access and emergency response access. Temporary exceptions, break-glass privileges, and recovery accounts should be tracked separately so that the team can prove which access is deliberate, which is temporary, and which should already have been removed.

Why the control matters most for containment, not paperwork

During a ransomware event, access recertification is valuable because it helps security teams reduce the number of reachable paths an attacker can still use. The control supports faster containment by confirming which accounts, entitlements, and sessions are safe to keep, and which should be disabled or narrowed before the attacker can reuse them.

That is especially important for dormant or mis-scoped access. If the programme only checks whether a manager clicked approve, it misses the operational question of whether the permission set increases the chance of spread, re-entry, or failed recovery. A strong review programme therefore becomes part of the response playbook, not a parallel audit exercise.

For teams managing machine, service, and application access as well as human access, the lifecycle angle matters. NHI Lifecycle Management Guide helps show why visibility, ownership, and offboarding discipline are relevant when access needs to be removed quickly and confidently. In the same vein, Joiner-Mover-Leaver (JML) Guide supports the idea that stale access usually comes from weak lifecycle hygiene, not a single bad decision.

For a related overview of where access reviews and certification frequently go wrong, Access Reviews and Certification Guide explains how review quality, reviewer fatigue, and closed-loop remediation affect whether recertification actually changes access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	AC-2 — Account Management	Recertification is an account review and removal control for active access
	AC-6 — Least Privilege	Ransomware containment depends on reducing excess permissions and blast radius
	IA-5 — Authenticator Management	Revocation and rotation of credentials matter when recertification exposes stale access
Recommendation — Review accounts regularly and remove unnecessary access quickly. Constrain access to the minimum needed for each role and task. Track, rotate, and revoke credentials when access is no longer justified.
CIS Controls v8	CIS-5 — Account Management	Access recertification directly supports account review and removal discipline
Recommendation — Maintain an inventory of accounts and disable access that no longer has a business need.
ISO/IEC 27001:2022	A.5.15 — Access control	Access reviews support controlled approval, restriction, and periodic validation of access
Recommendation — Define and enforce access rules with periodic review and removal.

Practitioner Guidance

What to prioritise: Review the access that can slow containment or restore adversary footholds first, including privileged, shared, remote, and service access tied to impacted systems. Low-risk, low-impact entitlements can wait if the programme is under pressure.

What to verify: Each certification should produce a clear decision trail: who owns the access, why it still exists, what changed since the last review, and what action was taken. If the review cannot support a removal or reduction decision, it is not yet operationally useful.

Practitioner takeaway: In a ransomware defence programme, recertification is only valuable when it changes access outcomes quickly enough to reduce exposure, not when it simply proves a review happened.