IDENTITY & ACCESS SECURITY
Protect the accounts that connect your people, partners and applications to the business. Make access deliberate—from the first sign-in to the final handover.
ACCESS IS A BUSINESS RESPONSIBILITY
It can open your email, approve a payment, change a cloud environment or reach a recovery system. Identity security asks who controls that account, what it can do and whether that access is still justified.
Give each identity an owner and a purpose. Include people, shared resources, applications and automated processes.
Match permissions to the task. Separate everyday work from privileged administration and review exceptions.
Roles change, contracts finish and tools are replaced. Removal needs the same ownership and evidence as approval.
MAP THE IDENTITIES AROUND YOUR BUSINESS
Email · Data · Cloud · Recovery
A role changes. The old permissions remain.
Compare current responsibilities with group memberships, shared folders and application roles. A move between departments should trigger a fresh access decision, not simply add another set of permissions.
One daily account also controls the environment.
Separate routine work from privileged administration. Review which tasks genuinely need elevated access, how that access is approved and how emergency access is protected and monitored.
The project ends. The remote access does not.
Record a business sponsor, permitted systems and an expiry or review date. Include guest accounts, remote support tools and any subcontractors involved in the service.
An integration inherits more authority than its task needs.
Identify service accounts, API credentials, app consent and connected AI agents. Record their owner and purpose, restrict scopes, and plan credential rotation and revocation without breaking critical processes.
Illustrative access map. The review should follow your actual applications, identity providers and business dependencies.
STRONGER SIGN-IN
Multifactor authentication adds another requirement at sign-in. The method matters: some approaches can still be phished, intercepted or approved by mistake. Review coverage and the exceptions that allow users or applications to bypass the expected checks.
CISA recommends phishing-resistant MFA. FIDO/WebAuthn-based methods can bind authentication to the legitimate service, helping resist credential phishing. Availability and deployment choices depend on your applications and environment. Read CISA’s guidance.
Start with privileged accounts, email and remote access, then plan broader coverage. Provide an enrolment and recovery process so stronger authentication does not leave staff unable to work.
REVIEW THE COMPLETE SIGN-IN PATH
Confirm the user’s identity before adding or replacing an authenticator. Protect registration and avoid allowing a compromised session to silently add a new method.
Check older protocols, unmanaged devices, service accounts and excluded users. Record why an exception exists and what compensating control or replacement plan applies.
A convincing caller should not bypass identity checks. Define how the service desk verifies a recovery request through trusted records and escalates unusual or high-risk resets.
ACCESS SHOULD FOLLOW THE PERSON
Identity work often breaks down at handovers between HR, managers, IT and application owners. Agree the trigger, the responsible person and the evidence that each change is complete.
01
Give a new starter what they need for their agreed work. Avoid copying every permission from a colleague whose role may have expanded over time.
02
A transfer, promotion or project assignment changes what is needed. Check what should be removed as well as what must be added.
03
Account closure is part of a coordinated departure process. Preserve required business records while removing the ability to act as the departing person.
WHERE ROUTINE REQUESTS BECOME RISK
These illustrative situations connect identity controls to the decisions your team makes every day. Expand a scenario to see what a focused review should examine.
A service-desk process needs a reliable identity check and a route for escalating suspicious requests. The caller’s urgency, voice or knowledge of a colleague is not enough to establish authority.
Useful evidence: A documented reset process, staff training and a record of how exceptional requests are approved.
Agree the exact task, systems and time window. Prefer a named identity and the minimum necessary privilege, with monitoring and a clear end to access. Confirm who approves the work and checks the outcome.
Useful evidence: An approved request, scoped permissions, activity records and confirmation that temporary access was removed.
Review the publisher, the requested scopes and the business purpose before granting consent. A useful integration may still ask for more access than it needs. Include ownership, data handling and revocation in the decision.
Useful evidence: The consent record, application owner, permitted data and a tested removal procedure.
A password change may not remove every session, token, delegated permission or persistence mechanism. Coordinate containment and investigation with the relevant platform owners.
Useful evidence: An incident record covering sessions, authentication methods, app consent, forwarding and privileged changes.
WHEN AN ACCOUNT MAY BE COMPROMISED
Use a trusted communication channel and involve the people responsible for the affected platform. Review active sessions, authentication methods and recently granted access while preserving relevant evidence.
Containment depends on the situation. Disabling a critical integration or administrator account can affect operations, so coordinate the action and a safe recovery route.
What data could it read? What settings could it change? Which other systems trusted it? A useful response follows those connections.
For an initial enquiry, share a brief description and a safe callback number. Do not send credentials or sensitive evidence.
A REVIEW THAT ENDS WITH CLEAR ACTIONS
Identify the critical platforms, identity sources and business owners. Include cloud services, remote access and recovery administration where relevant.
Examine agreed settings, role assignments, authentication coverage and lifecycle records. Use controlled checks and agreed access; technical testing is scoped separately.
Explain the business impact of the findings. Agree actions, owners and evidence needed to confirm improvement. Plan changes to avoid unnecessary disruption.
Deliverables depend on the agreed engagement. We can work alongside your existing IT team or service provider.
IDENTITY SECURITY, EXPLAINED
Password management is one part. Identity security also covers sign-in methods, access approval, privileged roles, application permissions, account recovery and removal. The aim is to control what an identity can do throughout its life.
Not necessarily. Start with the configuration, coverage and ownership of the systems you already use. A review may identify process changes or unused capabilities before a replacement is considered.
No. MFA significantly improves sign-in protection, but methods vary and attackers may target sessions, recovery processes or deceptive approvals. Combine strong authentication with limited access, monitoring and a tested response process.
We can discuss a scope around your business platforms and the evidence available. Confirm the specific services, licences, administrative access and responsibilities before the engagement begins.
Use a schedule matched to the sensitivity of the systems and the pace of change. High-impact privileges deserve particular attention. Also review access when people move roles, contracts end, applications change or an incident raises concern.
They need owners, a business purpose and limited permissions too. Review their credentials, scopes, integrations, logging and revocation process. Removing an employee account does not automatically remove every automation they created.
Evidence gathering and proposed changes should be planned with system owners. Changes to authentication, privileges or integrations require impact assessment, communication and a recovery path. Agree any active testing separately.
Bring a high-level list of important platforms, who manages access and the issues you want to address. Mention whether your concern is routine improvement or a suspected compromise. Do not send passwords, tokens or confidential user exports through the website form.
PRACTICAL READING
A practical way to review people, privileged accounts and applications without turning the exercise into an unmanageable spreadsheet.
Read article : Your first access review: start with the accounts that matterA practical verification process for finance teams facing unexpected payment changes, executive impersonation and convincing voice calls.
Read article : A familiar voice is not approval: checking urgent payment requestsUnderstand the difference between reading untrusted content and allowing that content to influence a connected business action.
Read article : Prompt injection: what changes when an AI assistant can act?START WITH THE ACCOUNTS THAT MATTER MOST
Tell us where you need confidence: privileged access, staff accounts, supplier permissions or connected applications.
