A certification cycle is the regular review process used to confirm whether people, systems, and non-human identities still need the access they have. In IAM governance, managers or application owners verify entitlements, remove excess access, and document approval, creating an audit trail that supports least privilege and compliance.
How Certification Cycles Work
Certification cycles are recurring access reviews. They turn access governance into a scheduled control, forcing someone accountable for the resource to confirm that each entitlement is still justified, correctly scoped, and tied to a current business need.
The practical value is not the calendar date itself, but the disciplined re-check of who can do what, on which systems, and under whose approval. That is why certification cycles are often used to catch access that was inherited, forgotten after a role change, or granted for a project that has already ended.
Why Certification Cycles Matter
These reviews help organisations preserve least privilege over time. Without them, access accumulates quietly as roles shift, teams reorganise, and temporary exceptions become permanent.
Certification cycles also create a control record. When a reviewer approves or removes access, that decision becomes part of the audit trail, which matters for proving that access governance is operating rather than just documented.
What Gets Reviewed in a Certification Cycle
A strong certification cycle is broader than a simple user list. It typically covers people, privileged accounts, application access, shared credentials, system entitlements, and non-human identities where those identities hold standing permissions or secrets that can outlive their original purpose.
The reviewer should be able to judge entitlement by entitlement, not just at the role label level. A role may look legitimate while still carrying excess access, inherited entitlements, or access that no longer matches the current job, service, or integration purpose.
Good certification also depends on context. Riskier access often needs more scrutiny than routine access, because ownership, sensitivity, and business impact determine whether a reviewer can make a reliable decision.
Certification Cycles and Access Governance Outcomes
Certification cycles are most effective when they close the loop. Review without removal leaves the control half-finished; review plus revocation, role correction, or documented exception handling is what actually improves posture.
They also expose governance problems upstream. Repeated recertification of the same access can indicate poor role design, weak joiner-mover-leaver handling, inconsistent ownership, or entitlement sprawl that should be fixed at the source rather than rediscovered every quarter.
Risk and Threat Considerations
Certification cycles matter because stale access is a common path to privilege creep, unnecessary exposure, and delayed revocation. When reviews are shallow or infrequent, excessive access can persist long enough to be abused by insiders, compromised accounts, or dormant non-human identities.
Failure mechanism: Access that should have been removed remains active because reviewers rubber-stamp large populations, lack context, or do not have clear ownership for the entitlement being certified.
Impact: The organisation keeps an inaccurate access state, which increases the blast radius of account compromise, weakens least privilege, and can create audit findings when approvals cannot be tied to a real business need.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Certification cycles review and remove unused or excess access over time. |
| AC-6 — Least Privilege | Certification cycles reinforce least privilege by trimming standing entitlements. | |
| IA-5 — Authenticator Management | Certification cycles may uncover stale credentials and secrets tied to accounts. | |
| Recommendation — Use AC-2 to require periodic review and revocation of unnecessary account access. Apply AC-6 to limit retained access to the minimum required for the role or service. Use IA-5 to rotate or revoke authenticators that should no longer remain active. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Certification cycles operationalise periodic access right review and removal. |
| Recommendation — Review and remove access rights at defined intervals and on role change. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Certification cycles are a core way to manage entitlement review and removal. |
| Recommendation — Implement periodic access review to remove unneeded accounts and entitlements. | ||
Practitioner Guidance
Why practitioners should care: Treat certification cycles as a control outcome, not a paperwork exercise. The review should be designed to remove access, not merely confirm that access exists.
Governance implication: Assign accountable reviewers for each access population and make sure they can understand the entitlement context well enough to approve, reduce, or revoke it confidently.
Practitioner takeaway: A certification cycle is only effective when the organisation can prove that review decisions change access state, not just produce evidence of review.
Related resources from NHI Mgmt Group
- Who is accountable when a user retains unauthorized access after a certification cycle?
- Who is accountable when GitHub access decisions are approved, modified, or revoked during a certification cycle?
- When should identity risk override a scheduled certification cycle?
- What breaks when agent access is reviewed only on a normal certification cycle?