Subscription recertification

A periodic review of whether a software subscription is still needed, still used, and still owned by the right team. It applies access review logic to SaaS spend, turning renewal windows into a control point for reclaiming waste and reducing orphaned access.

Expanded Definition

Subscription recertification is the disciplined review of SaaS subscriptions at fixed intervals or renewal milestones to confirm that each subscription is still required, still actively used, and assigned to the correct business owner. In NHI security terms, it borrows from access recertification, but the control target is spend, ownership, and dormant SaaS entitlements rather than only user permissions.

The practice matters because software subscriptions often accumulate outside procurement oversight, especially when teams self-serve tools with shared cards or delegated admins. That creates a governance gap between finance, operations, and security. The most mature programs tie recertification to asset inventories, owner attestation, and offboarding workflows so that forgotten subscriptions and orphaned accounts are removed before renewal. This aligns closely with the accountability model described in NIST Cybersecurity Framework 2.0 and with NHI lifecycle discipline in Ultimate Guide to NHIs — What are Non-Human Identities.

Definitions vary across vendors on whether recertification includes only financial approval or also technical validation of active use, downstream access, and data retention obligations. The most common misapplication is treating renewal as a purchasing formality, which occurs when no one verifies whether the subscription still has an accountable owner or still contains active access.

Examples and Use Cases

Implementing subscription recertification rigorously often introduces review overhead at renewal time, requiring organisations to weigh quick continuity against the cost of keeping unused tools, stale permissions, and duplicated platforms.

• Finance routes every annual SaaS renewal to the named business owner for attestation before the invoice is approved.
• Security reviews collaboration platforms and developer tools for dormant service accounts, shared logins, or lingering API tokens before renewal.
• Procurement checks whether a team already has an approved platform in place, using the renewal window to retire redundant subscriptions and consolidate vendors.
• Operations validates whether the subscription still supports a live workflow, then coordinates deletion or export if the tool is no longer required.
• After an incident, teams compare active subscriptions against identity inventories to find orphaned admin access and unowned SaaS tenants, a pattern reflected in the Sisense breach analysis and in the NIST view of continuous monitoring.

In practice, this control is most effective when tied to renewal notices, CMDB records, and identity governance triggers so that attestation happens before funds are committed and access remains open. The operational logic is closely related to NHI review patterns described in the Ultimate Guide to NHIs — What are Non-Human Identities.

Why It Matters in NHI Security

Subscription recertification is not just a cost-control exercise. It is a governance mechanism for uncovering hidden access, weak ownership, and expired accountability across SaaS environments where non-human identities often persist long after the original use case has ended. NHIMG research shows that 97% of NHIs carry excessive privileges, which means an unreviewed subscription can also conceal over-privileged integrations, stale tokens, or delegated admins that no one is actively monitoring.

When organisations skip recertification, they keep paying for unused services while also preserving attack paths that should have been removed during offboarding. This weakens least privilege, complicates incident response, and makes it harder to prove ownership of data and access. The control also supports a broader risk posture described by NIST Cybersecurity Framework 2.0, where inventory, governance, and protective controls reinforce each other.

Organisations typically encounter the consequence only after a breach review, audit finding, or surprise renewal spend spike, at which point subscription recertification becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between access recertification and access provisioning?
• What breaks when non-human identities are not included in recertification?
• How should organisations evaluate PAM beyond subscription pricing?
• When should organisations trigger access reviews outside the normal recertification cycle?