Identity Governance Program-in-a-Box

An identity process tells IT what to do when someone joins or leaves. An identity governance program tells the whole organization what is required, who decides, how exceptions are handled, and how anyone will know it is working. This kit delivers both, sized for organizations without an identity team.

The program set includes an Identity Governance Policy, a Privileged Account Standard with tiers, dedicated admin accounts, phishing-resistant MFA and emergency access accounts, a Service Account Standard, an Account Lifecycle Procedure with service levels, separate Joiner, Mover and Leaver procedures, an Access Review Procedure, an Identity Exception Procedure, and an Implementation Roadmap with a 90-day maturity plan and exit criteria.

The workbook, program edition, adds a Dormant Account Review, a monthly Terminated User Check against HR's leaver list, an Exceptions register, eleven calculated program metrics with status, Metric History for quarterly trends, and a 90-Day Plan tracker, on top of the full toolkit.

Everything is editable Word and Excel with bracketed substitution points, a responsibility matrix, and a crosswalk to NIST CSF 2.0, CIS Controls v8.1 and ISO/IEC 27001:2022.

What is included

1. Program Implementation Guide and Workbook Implementation Guide (PDF).

2. Identity Governance Policy, Privileged Account Standard, Service Account Standard (Word).

3. Account Lifecycle, Joiner, Mover, Leaver, Access Review and Identity Exception procedures (Word).

4. Identity and Account Governance Workbook, program edition (Excel), with account inventory and review dashboard.

5. Eleven forms including the access request form and exception request (Word).

6. Implementation Roadmap and 90-Day Maturity Plan (Word).

Who it is for

IT managers and directors, system administrators, security engineers and analysts, compliance and risk managers, and MSP teams at organizations of roughly 25 to 500 people that run Microsoft 365, Google Workspace or similar platforms but have no formal identity governance process.

Formats

10 program documents, 11 forms, Excel workbook, 2 PDF guides.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.