Topic starter
19/08/2026 3:32 pm
TL;DR: Identity data attestation makes access reviews, audit responses, and governance decisions depend on verified records, because Hydden shows connectors, mappings, entitlements, and vault data can diverge. Reconciled identity records let access governance rest on evidence instead of assumption.
Editorial analysis by NHI Mgmt Group, based on content published by Hydden: “How Do You Know Your Identity Data Is Right?”.
Key questions
Q: When does data accuracy become a governance problem rather than a technical one?
A: Data accuracy becomes a governance problem when multiple systems hold different versions of the same business fact and no one owns the authoritative record.
Q: What are the signs that identity data is out of sync across systems?
A: Common signs include role changes that appear in one directory but not another, offboarded users still present in at least one account store, and IdP lookups that return conflicting attributes.
Q: What breaks when access reviews are the primary identity control?
A: The control breaks because access can change, be abused, and disappear between review cycles.
Practitioner guidance
- Verify collector and mapping integrity Test the connector configuration, attribute mappings, and collection scope before each certification cycle so the review is based on current source data rather than a stale snapshot.
- Reconcile governance views against source records Compare accounts, roles, memberships, and entitlement sets side by side between the governance platform and the authoritative system to surface drift before approval.
- Certify vault contents against authoritative sources Require PAM or password manager records to reconcile back to directory and application sources so vaulted accounts are only approved when ownership and existence still align.
Bottom line: Identity attestation addresses a basic but often ignored problem: access reviews can be completed against incorrect identity data and still appear successful.
Glossary terms: Identity Data Attestation, Connector Drift, Vault Reconciliation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
19/08/2026 4:14 pm
Data attestation is a governance control, not a review feature. The point is not to speed up certification but to prove that the data being certified is correct before a decision is recorded. In practice, that moves attestation upstream of approval and makes data integrity part of the control objective. Organisations that treat review completion as evidence of correctness are confusing workflow completion with governance assurance.
A question worth separating out:
Q: How should auditors evaluate evidence from completed access reviews?
A: Auditors should look for more than a returned spreadsheet. The stronger evidence is a durable record that shows the reviewed datasets, the configuration used to collect them, the reviewer who signed off, and the activity history behind the decision. That lets the examiner test whether the evidence itself was reliable.
👉 Read our full editorial: Identity data attestation closes the gap in access reviews