Services and approach
A defined engagement with an independent identity expert. Together we find out who can get into your systems, design how that access is governed, and put it in place at a pace your business sets.
Areas of work
Identity discovery and mapping
Employees, contractors, partners, vendors and customers all reach your systems in different ways. Working side by side with your team, we find every one of those edges and trace each back to the identity behind it, so nothing is left unaccounted for.
What it covers
- Every way in, internal and external, found and listed.
- Each one traced back to how that person is identified.
- The gaps, as the starting point for what to fix first.
Application access and SSO coverage
Together with your team, we work out how people and service accounts get into each application, whether it sits behind single sign-on, and whether MFA is actually enforced. The gap analysis that follows shows which systems fall outside policy and what it takes to bring them in.
What it covers
- An inventory of the systems your identities reach, and how each one authenticates.
- Single sign-on and MFA coverage, checked system by system against your policies.
- A gap analysis with the work needed to bring each system into policy.
Governance and policy design
Together with your team, we design the policies that decide who gets access, how it is approved and how often it is reviewed: roles, least privilege, and joiner, mover and leaver rules. Zero Trust is the starting point, and the result is a roadmap your business sets the pace on.
What it covers
- Role models and least-privilege access, built from the inventory.
- Approval rules and access review cycles.
- Joiner, mover and leaver rules, with Zero Trust principles as the starting point.
Gap and risk report
Whether your team works through the roadmap at its own pace or we implement the changes together, we conclude the engagement with a gap and risk report. It shows the applications in your environment, the policies governing access to them, and how you recertify that access in the future. It also calls out any risk acceptance required during the engagement.
What it covers
- The applications in your environment and the policies that govern access to them.
- How that access is recertified from here on, and any risk acceptance made along the way.
- Controls mapped to SOX, ISO and NIST, with the evidence an assessor asks for.
PDF, one page, 26 KB
How we work
Every use case is unique. We start with your working environment, identify the risks, then custom build an approach that satisfies compliance without disrupting operations.
Situations that come up often
Each page describes a type of problem, how we work through it and what you end up with. None is about a particular client.
Consolidation of identities after a merger
Two (or more) companies that need to be consolidated into one. Where the work usually starts, what drives the timeline and what you end up with.
Preparing for an audit
Audits for an investor, for going public or after an incident. Where the work starts, what auditors ask for and what you end up with.
Bringing applications under SSO and MFA
Applications that sit outside single sign-on and MFA. Why they stay there, how to decide what comes first and what each conversion gets you.
Managing access when people join, move or leave
Access that lingers after people change roles or leave. Where it shows up, how the systems get connected and what you end up with.
Talk through your environment
Share a little about your environment and what is coming up, and we'll find a time to look at where to start.
Or write to contact@secureiga.net