A former employee's password that still works. An administrator without a second factor. A service account password sitting in a script. A contractor login nobody remembered. Most breaches of growing organizations start with an account, and most organizations cannot say who has access to what, or who approved it.
The question usually arrives from an auditor, an insurer or an incident, and it has to be answered with evidence, not memory.
Identity risk is not one problem. It is five, and identity technology on its own solves none of them.
1. Leavers keep access. Accounts are disabled late or not at all, and the sessions, tokens, forwarding rules and shared passwords they knew are never touched.
2. Access piles up. People change roles and keep everything they had before, and new access is granted on a message rather than an approval.
3. Admin and service accounts nobody owns. Privileged accounts without a second factor, service accounts with passwords that never change, and dormant accounts nobody notices.
4. Nobody checks. Access reviews are skipped, or a manager approves every line without reading it.
5. You cannot prove any of it. No policy, no standard for privileged or service accounts, no exception process and nothing to hand an auditor or insurer.
START HERE, FREE
Twenty-five questions across ten areas of account management and fifteen minutes. The Account Security Health Check places you at Foundational, Developing or Managed, and caps your result if any of three critical gaps is present, because each one is on its own a common route to a breach.
Measures: parts 1 to 4.
Solves: none of them, on purpose. It tells you where to start.
ACCOUNT LIFECYCLE STARTER KIT, $9
Nine forms and checklists, ready to use this week, and a starter register that flags dormant, unowned, expired, shared and privileged-without-MFA accounts on its own.
Solves part 1. A leaver checklist that goes well beyond disabling the account: sessions and tokens, MFA methods, forwarding rules, shared passwords and the subscriptions the leaver owned.
Solves part 2. A mover checklist that makes new access replace old access, and an access request and approval record so nothing is granted on a message.
Starts part 3. Review forms for privileged, service and dormant accounts. Tracking them on a schedule is in the Toolkit.
Starts part 4. An account review checklist. A full access review campaign with a line-by-line worksheet is in the Toolkit.
Still open: part 5. Nothing here proves the program to anyone else yet.
IDENTITY AND ACCOUNT GOVERNANCE TOOLKIT, $39 AT LAUNCH
One twelve-tab workbook answers who has access to what, who approved it, who owns it, and whether leavers lose access on time, with a six-week rollout in the implementation guide.
Solves parts 1 and 2, with joiner, mover and leaver trackers that score each stage against a service level, role templates, and an access request log with separation of duties checks.
Solves part 3. Privileged and service account reviews, and an account inventory that flags every dormant, unowned, shared or privileged-without-MFA account automatically.
Solves part 4. Quarterly access reviews with a line-by-line worksheet and rubber-stamp detection, so an approval nobody read shows up.
Starts part 5. An eighteen-figure dashboard and an identity exception form give you evidence of the work. There is no approved policy or standard yet.
IDENTITY GOVERNANCE PROGRAM-IN-A-BOX, $129 AT LAUNCH
The Toolkit runs the process. The Program adds the authority behind it, and closes the last part of the problem. Adopt it in ninety days with the implementation roadmap and its exit criteria.
Solves parts 1 to 4, with the full Toolkit workbook, extended with a dormant account review, a monthly terminated user check against the leaver list from HR, and an exceptions register.
Solves part 5. An Identity Governance Policy, a Privileged Account Standard with tiers, dedicated admin accounts, phishing-resistant MFA and emergency access accounts, a Service Account Standard, lifecycle, joiner, mover, leaver, access review and exception procedures, and eleven program metrics with quarterly history.
Aligned to NIST CSF 2.0 PR.AA, CIS Controls v8.1 Controls 5 and 6 and ISO/IEC 27001:2022 controls 5.15 to 5.18, 8.2 and 8.5, with a crosswalk included. It supports those requirements; it does not certify against them.
Even a complete program needs someone to run it: to chase the reviews, read the exceptions, and make the call when an administrator asks to keep access they no longer need. If you want that person, the practice provides senior security leadership on retainer.
Take the free health check first. If you score Foundational, or it flags a critical gap, start with the Starter Kit. If you score Developing, go straight to the Toolkit. If leadership, a customer or an auditor has asked for a written, approved program, choose the Program.
Yes. Right after checkout, each tier offers the next one at a discount that credits what you already paid, so starting with the Starter Kit costs you nothing extra.
No. These manage the process around whatever you already use, such as Microsoft 365 or Google Workspace. The Toolkit's guide shows where to find the data in common identity platforms.
