Is this action an example of provisioning? Reviewing an identity’s access during a certification campaign

Provisioning is the process of creating, modifying, or deleting user accounts and their access entitlements on target systems. It is an action that grants, changes, or revokes access. In contrast, a certification campaign is a governance process focused on reviewing and validating existing access to ensure it is still appropriate. This review does not, by itself, constitute provisioning; it is a control mechanism that may trigger provisioning actions (like revocation) as a result.

A. This is incorrect because reviewing access is a governance and compliance function known as access certification or attestation, not the act of provisioning access.

1. SailPoint IdentityIQ 8.1, User Guide, "Glossary of Terms," p. 161. Defines "Access Certification" as "A review process in which a user's access rights are reviewed and either approved or revoked."

2. SailPoint IdentityIQ 8.1, User Guide, "Glossary of Terms," p. 165. Defines "Provisioning" as "The process of creating, maintaining, and deleting accounts and access rights for individuals in one or more systems or applications."