Services|12
Identity and Access
Identity and access, so the right person can get in and a leaver cannot.
Most breaches we are asked to clean up started as an account that should have been closed, or a password that was shared because the real process was slower.
We write the groups to match the job. Admin is rare. A contractor expires. Conditional access is for the cases that deserve it, not a puzzle the staff will work around.
This is the spine of Microsoft 365, Google Workspace and the custom systems. It is not a separate login to manage the other logins.
What that includes
- Groups that match the job, not a growing list of exceptions
- Starters and leavers as a routine, not a favour
- Admin accounts that are few and watched
- Sign-in rules a person can live with on a busy morning
- A review, so access does not quietly spread
Questions
Why do leavers still get into the files?
Because access was granted as a favour and never written as a job. We rebuild the groups around the role, and close them the day the person leaves.
Will staff be locked out of their own work?
No. The rule has to survive a busy morning. A control people switch off is not a control.
How often is access reviewed?
On a schedule in the plan, and whenever someone joins or leaves. It does not wait for an incident.
Sectors this serves