Attestation and certification of business roles with the New certification status can start when the following requirements are met.
To certify new business roles
-
In the Designer, set the QER | Attestation | OrgApproval and QER | Attestation | OrgApproval | InitialApprovalState configuration parameters.
-
The value of the InitialApprovalState configuration parameter to 1.
All business roles added to the database from this point on are given the certification status New.
-
In the Manager, edit the main data of the New business roles certification attestation policy.
-
In the Manager, assign at least one employee to the Identity Management | Business roles | Administrators application role.
- Save the changes.
Attestation and certification is started automatically for business role that were added with the Analyzer tool.
The Employees do not inherit option (Org.IsNoInheriteToPerson) is disabled by the VI_Attestation_AttestationCase_Org_Approval_Granted process.
Related topics
Attestation and certification of application roles with the New certification status can start when the following requirements are met.
To certify new application roles
-
In the Designer, set the QER | Attestation | AERoleApproval and QER | Attestation | AERoleApproval | InitialApprovalState configuration parameters.
-
The value of the InitialApprovalState configuration parameter to 1.
All application roles added to the database from this point on are given the certification status New.
-
In the Manager, edit the main data of the New application roles certification attestation policy.
-
In the Manager, assign at least one employee to the Base roles | Administrators application role.
- Save the changes.
Related topics
Violation of regulatory requirements can harbor different risks for companies. To evaluate these risks, you can apply risk indexes to attestation policies. These risk indexes provide information about the risk involved for the company if this particular policy is violated. Once the risks have been identified and evaluated, mitigating controls can be implemented.
Mitigating controls are independent on One Identity Manager’s functionality. They are not monitored through One Identity Manager.
Mitigating controls describe controls that are implemented if an attestation rule was violated. The attestation can be approved after the next attestation run, once controls have been applied.
To edit mitigating controls
- In the Designer, set the QER | CalculateRiskIndex configuration parameter and compile the database.
If you disable the configuration parameter at a later date, model components and scripts that are not longer required, are disabled. SQL procedures and triggers are still carried out. For more information about the behavior of preprocessor relevant configuration parameters and conditional compiling, see the One Identity Manager Configuration Guide.
For more information about risk assessment, see the One Identity Manager Risk Assessment Administration Guide.
To create or edit mitigating controls
-
In the Manager, select the Risk index functions > Mitigating controls category.
-
Select a mitigating control in the result list and run the Change main data task.
- OR -
Click 
in the result list.
-
Edit the mitigating control main data.
- Save the changes.
Enter the following main data of mitigating controls.
Table 65: General main data of a mitigating control
|
Measure |
Unique identifier for the mitigating control. |
|
Significance reduction |
When the mitigating control is implemented, this value is used to reduce the risk of denied attestation cases. Enter a number between 0 and 1. |
|
Description |
Detailed description of the mitigating control. |
|
Functional area |
Functional area in which the mitigating control may be applied. |
|
Department |
Department in which the mitigating control may be applied. |
