Managers or others responsible for compliance can use the One Identity Manager attestation functionality to certify correctness of access permissions, authorizations, requests, or exception approvals either scheduled or on demand. Recertification is the term generally used to describe regular certification of permissions. One Identity Manager uses the same workflows for recertification and attestation.
There are attestation policies defined in One Identity Manager for carrying out attestations. Attestation policies specify which objects are attested when, how often, and by whom. Once an attestation is performed, One Identity Manager creates attestation cases that contain all the necessary information about the attestation objects and the attestor responsible. The attestor checks the attestation objects. They verify the correctness of the data and initiate any changes that need to be made if the data conflicts with internal rules.
Attestation cases record the entire attestation sequence. Each attestation step in the attestation case can be audit-proof reconstructed. Attestations are run regularly using scheduled tasks. You can also trigger single attestations manually.
Attestation is complete when the attestation case has been granted or denied approval. You specify how to deal with granted or denied attestations on a company basis.
To use attestation functionality
- In the Designer, set the QER | Attestation configuration parameter.
The following users are used for attestation.
Table 1: Users
| Administrators for attestation cases |
Administrators are assigned to the Identity & Access Governance | Attestation | Administrators application role.
Users with this application role:
- Define attestation procedures and attestation policies.
- Create approval policies and approval workflows.
- Specify which approval procedure to use to find attestors.
- Set up attestation case notifications.
- Configure attestation schedules.
- Enter mitigating controls.
- Create and edit risk index functions.
- Monitor attestation cases.
|
| One Identity Manager administrators |
-
Create customized permissions groups for application roles for role-based login to administration tools in the Designer as required.
-
Create system users and permissions groups for non role-based login to administration tools in the Designer as required.
-
Enable or disable additional configuration parameters in the Designer as required.
-
Create custom processes in the Designer as required.
-
Create and configure schedules as required.
-
Create and configure password policies as required. |
| Attestors |
- Check attestation objects in the Web Portal.
- Confirm data correctness.
- Initiate changes if data conflicts with internal rules.
Attestators in charge are determined through approval procedures. |
| Compliance and security officer |
Compliance and security officers must be assigned to the Identity & Access Governance | Compliance & Security Officer application role.
Users with this application role:
- View all compliance relevant information and other analysis in the Web Portal. This includes attestation policies, company policies and policy violations, compliance rules, and rule violations and risk index functions.
- Edit attestation polices.
|
| Auditors |
Auditors are assigned to the Identity & Access Governance | Auditors application role.
Users with this application role:
- See the Web Portal all the relevant data for an audit.
|
| Chief approval team |
The chief approver must be assigned to the Identity & Access Governance | Attestation | Chief approval team application role.
Users with this application role:
- Approve using attestation cases.
- Assign attestation cases to other attestors.
|
The attestation framework and the objects to be attested are specified in the attestation policy. You require certain base data to define attestation policies.
Attestation types are used to group attestation procedures. These make it easier to assign a matching attestation procedure to the attestation policies.
To edit attestation types
-
Select the Attestation | Basic configuration data | Attestation types category.
-
Select an attestation type in the result list and run the Change master data task.
– OR –
Click 
in the result list.
-
Edit the attestation type master data.
- Save the changes.
