Identity and Account Governance Toolkit

Identity technology decides how people sign in. It does not decide who should have access, notice when someone changed departments, or check that a contractor's account ended with the contract. That is identity governance, and this toolkit makes it a process you can run and prove.

The workbook includes a System Register with system owners and review schedules, an Account Inventory that automatically flags dormant, unowned, expired, shared and privileged-without-MFA accounts, Role Templates, an Access Request log with separation of duties checks, Joiner, Mover and Leaver trackers with stage tracking and service level scoring, Privileged and Service Account Reviews, Quarterly Access Reviews with a line-by-line worksheet and rubber-stamp detection, and an eighteen-figure dashboard.

The implementation guide explains every flag and calculation, gives a six-week rollout, shows where to find the data in common identity platforms, and lists the findings most organizations of 25 to 500 people discover in their first month.

Aligned to NIST CSF 2.0 PR.AA, CIS Controls v8.1 Controls 5 and 6, and ISO/IEC 27001:2022 controls 5.15 to 5.18, 8.2 and 8.5.

What is included

1. Identity and Account Governance Workbook (Excel), twelve working tabs plus Reference, with worked examples.

2. Toolkit Implementation Guide (PDF).

3. Eleven Word forms: joiner, mover and leaver checklists; access request and approval; account, privileged, service and dormant reviews; access review certification; identity exception request.

Who it is for

IT managers and directors, system administrators, security engineers and analysts, compliance and risk managers, and MSP teams at organizations of roughly 25 to 500 people that run Microsoft 365, Google Workspace or similar platforms but have no formal identity governance process.

Formats

Excel workbook, PDF implementation guide, 11 Word forms.

License

License. Your purchase grants one organization a perpetual, non-exclusive license to use, copy, and modify these materials for its own internal security program, including sharing completed questionnaires and contract exhibits with its own vendors. You may not resell, sublicense, or redistribute the templates themselves, in original or modified form, as a product. Consultants and managed service providers who want to use the materials across multiple client organizations need a practitioner license; contact cyberauctoritas.com.

Disclaimer

This material is provided for general information and internal program building. It is not legal advice and does not certify compliance with any law, regulation, or framework. Contract language must be reviewed by qualified counsel before use. Adapt every document to your organization, your risk tolerance, and your obligations.