People and access
Joiners, movers and leavers, with the access each one holds.
People and access
The people record underneath access reviews and training: departments, roles, start and end dates, background checks and the systems each person can reach. Handover makes it explicit who inherits a leaver's responsibilities.
Key capabilities
- Department and role structure
- Background check records with evidence
- Ownership lines and documented handover
- SCIM provisioning and SAML just-in-time accounts
Access reviews
Run a review campaign on a recurrence, have owners confirm or revoke each entitlement, and track revocations to completion rather than assuming they happened. Person history shows what somebody has held over time.
Key capabilities
- Recurring campaigns on a schedule you set
- Per-entitlement confirm or revoke, recorded
- Revocations tracked to completion
- Person access history over time
Training and awareness
Role-based learning paths, refresher cycles and completion tracking, with courses linked to the controls and policies they support.
Key capabilities
- Course catalogue with your own content
- Role-based paths and refresher cycles
- Completion tracking and certificates
- Links from courses to controls and policies
Proof point
The person who remediated a finding cannot verify it. Separation of duties is enforced by the platform, not left to process, and the same rule applies to risk acceptance.
Questions about this
How often should access reviews run?
Quarterly for privileged access and at least twice a year for everything else, with removals recorded.
What evidence do auditors want for offboarding?
The leaver date from HR and the access-removal timestamps from identity and cloud systems, ideally within one business day.
Is security training required?
Yes, at onboarding and annually, with completion records. Certifyi tracks assignment and completion.
Which systems feed personnel evidence?
Okta, Google Workspace, Microsoft Entra, Auth0 and HR systems through read-only integrations.