Account Security Health Check

Most breaches of small and mid-sized organizations start with an account: a former employee's password that still works, an administrator without MFA, a service account password in a script, a vendor login nobody remembered. This health check tells you in fifteen minutes how well your organization manages those accounts.

It covers employee accounts, privileged accounts, service accounts, contractors, terminated users, dormant accounts, access reviews, MFA, shared accounts and ownership. The self-scoring workbook places you at Foundational, Developing or Managed, charts every category, and caps the result if any of three critical gaps is present, because each of them is on its own a common route to a breach.

It assesses the management process around identity, not your identity technology.

What is included

1. Account-Security-Health-Check.pdf, a printable assessment with scoring, critical gap explanations and 30-day actions for each level.

2. Account-Security-Health-Check-Scoring.xlsx, which scores itself, flags critical gaps and charts your categories.

Who it is for

IT managers and directors, system administrators, security engineers and analysts, compliance and risk managers, and MSP teams at organizations of roughly 25 to 500 people that run Microsoft 365, Google Workspace or similar platforms but have no formal identity governance process.

Formats

PDF, Self-scoring Excel workbook.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.