// access reviews
Certified against what actually happened
An access review is only defensible if the reviewer could see what the identity actually did. Ours puts entitlements and activity on the same page.
// the problem
The spreadsheet review nobody believes
A manager is sent a list of names and permissions with no way to tell whether any of it was used, or used properly. They approve everything, because approving everything is the only option the format offers.
A review is only defensible if the reviewer could see what the identity actually did. Ours puts the entitlement and the activity on the same page.
// two judgements
Every review asks two different questions
These are separate assessments and the distinction matters: access can be correct and still have been misused, and it can be excessive without anyone having abused it yet.
- Entitlement recertification
Is this identity's access right? Decided as retain, modify or revoke, with an appropriateness verdict attached: appropriate, excessive, or unjustified.
- Activity conformance
Did the identity act consistently with what it is? A non-privileged identity taking privileged or destructive actions, or a privileged identity taking destructive actions in production, surfaces here.
The reviewer is not asked to read raw logs. The anomalies that matter are surfaced; the rest stays out of the way.
// the period
One window bounds everything
A review runs over a defined period, and every entitlement and every activity log assessed inside it belongs to that same window. That is what makes the result mean something specific rather than approximately recent.
- The window opensScheduled control activity
Reviews are periodic and deadline-bound, not one-off exercises. The period start and end scope every judgement made inside.
- Entitlements are assembledPlatform
Pulled from the asset and identity spine — the real entitlements on real resources, not an export somebody generated last quarter.
- Activity is attachedPlatform
Each identity's logged actions over the same period sit alongside its entitlements, so the reviewer is judging behaviour rather than guessing at it.
- Decisions are recordedReviewer
Retain, modify or revoke, plus an appropriateness verdict and a conformance assessment. Named reviewer, timestamped.
- Findings become workPlatform
Every revoke and every out-of-scope finding becomes an access management remediation task with an SLA, chased until it closes.
// done means done
Three things have to be true before a review counts
A completed review is not a signed list. It has to satisfy all three of these.
- Remediation tracked to closure — every actionable finding became a task chased until it closed, along the same path every other finding takes
- Audit-ready export — the review can be handed to an auditor as evidence of who reviewed what, when, and what they decided.
- Coverage assurance — proof that in-scope access, privileged access especially, was fully reviewed, with any gaps flagged explicitly rather than left implicit.
// framework-agnostic
One review, every framework
Access review results are required as access-control evidence across every framework the platform supports. The review is not scoped to one of them, so running it once satisfies all of them.
- SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and the rest draw on the same completed review — compare the frameworks
- Reviews can be created and run by your CISO or a contributor; internal auditors and subscribed viewers can read them independently.
- The outputs are work, not just a record — which is the difference between a review that improves your security and one that documents it.
// questions this answers
How access reviews work, answered directly
What makes an access review defensible?
Three things have to be true: every actionable finding became a task that was chased to closure, the review exports as evidence showing who reviewed what and when, and there is proof that in-scope access — privileged access especially — was fully covered, with gaps flagged explicitly.
How is this different from sending managers a spreadsheet?
A spreadsheet shows names and permissions with no way to tell whether the access was used or misused, so reviewers approve everything. Konfirmity puts each identity's entitlements and its real logged activity over the same period side by side.
Do I need a separate review for each framework?
No. Access review results are required as access-control evidence across every framework the platform supports, so one completed review serves SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR and the rest.
// keep reading
Where this goes deeper
Want to see this one live?
Book 30 minutes and we will walk through “Certified against what actually happened” in the actual platform, using your environment as the example.