Chat now with support
Chat mit Support

Identity Manager 8.1 - Attestation Administration Guide

Attestation and recertification
One Identity Manager users for attestation Attestation base data Attestation policies Creating custom mail templates for notifications
Approval processes for attestation cases
Approval policies Approval workflows Selecting attestors Setting up multi-factor authentication for attestation Prevent attestation by employee awaiting attestation Managing attestation cases
Attestation sequence Default attestation and withdrawal of entitlements User attestation and recertification Mitigating controls Appendix: Configuration parameters for attestation

Attestation and recertification

Managers or others responsible for compliance can use the One Identity Manager attestation function to certify correctness of access permissions, authorizations, requests, or exception approvals either scheduled or on demand. "Recertification" is the term generally used to describe regular certification of permissions. One Identity Manager uses the same workflows for recertification and attestation.

Attestation policies are defined in the One Identity Manager, which you use to carry out attestations. Attestation policies specify which objects are attested when, how often and by whom. Once an attestation is performed, One Identity Manager creates attestation cases, which contain all the necessary information about the attestation objects and the attestor responsible. The attestor checks the attestation objects. They verify the correctness of the data and initiate any changes that need to be made if the data conflicts with internal rules.

Attestation cases record the entire attestation sequence. Each attestation step in the attestation case can be audit-proof reconstructed. Attestations are run regularly using scheduled tasks. You can also trigger single attestations manually.

Attestation is complete when the attestation case has been granted or denied approval. You specify how to deal with granted or denied attestations on a company basis.

TIP: One Identity Manager provides various default attestation procedures for different data situations and default attestation procedures. If you use these default attestation procedures, you can configure how you deal with denied attestations.

For more information, see Default attestation and withdrawal of entitlements.

To use attestation functionality

  • In Designer, set the QER | Attestation configuration parameter.

One Identity Manager users for attestation

The following users are used for attestation.

Table 1: Users
Users Task
Administrators for attestation cases

Administrators are assigned to Identity & Access Governance | Attestation | Administrators.

Users with this application role:

  • Define attestation procedures and attestation policies.
  • Create approval policies and approval workflows.
  • Specify which approval procedure to use to find attestors.
  • Set up attestation case notifications.
  • Configure attestation schedules.
  • Enter mitigating controls.
  • Create and edit risk index functions.
  • Monitor attestation cases.
One Identity Manager administrators
  • Create customized permissions groups for application roles for role-based login to administration tools in Designer as required.

  • Create system users and permissions groups for non-role-based login to administration tools in Designer as required.

  • Enable or disable additional configuration parameters in Designer as required.

  • Create custom processes in Designer as required.

  • Create and configures schedules as required.

  • Create and configure password policies as required.

Attestors
  • Check attestation objects in the Web Portal.
  • Confirm data correctness.
  • Initiate changes if data conflicts with internal rules.

Attestators in charge are determined through approval procedures.

Compliance and Security Officer

Compliance and security officers must be assigned to Identity & Access Governance | Compliance & Security Officer.

Users with this application role:

  • View all compliance relevant information and other analysis in the Web Portal. This includes attestation policies, company policies and policy violations, compliance rules, and rule violations and risk index functions.
  • Edit attestation polices.
Auditors

Auditors are assigned to the application role Identity & Access Governance | Auditors.

Users with this application role:

  • See the Web Portal all the relevant data for an audit.
Chief approval team

The chief approver must be assigned to Identity & Access Governance| Attestation | Chief approval team.

Users with this application role:

  • Approve using attestation cases.
  • Assign attestation cases to other attestors.

Attestation base data

The attestation framework and the objects to be attested are specified in the attestation policy. You require certain base data to define attestation policies.

Attestation types: Attestation types
Approval policies: Approval policies
Approval workflows: Approval workflows
Approval procedures: Setting up approval procedures
Attestation procedures: Attestation procedure
Schedules: Schedules
Compliance frameworks: Compliance frameworks
Mail templates: Creating custom mail templates for notifications
Chief approval team: Chief Approval Team
Standard reasons: Standard reasons

Attestation types

Attestation types are used to group attestation procedures. These make it easier to assign a matching attestation procedure to the attestation policies.

To edit attestation types

  1. Select Attestation | Basic configuration data | Attestation types.

  2. Select an attestation type in the result list and run Change master data.

    - OR -

    Click in the result list toolbar.

  3. Edit the attestation type master data.

  4. Save the changes.
Self-Service-Tools
Knowledge Base
Benachrichtigungen und Warnmeldungen
Produkt-Support
Software-Downloads
Technische Dokumentationen
Benutzerforen
Videoanleitungen
RSS Feed
Kontakt
Unterstützung bei der Lizenzierung
Technische Support
Alle anzeigen
Verwandte Dokumente