Identity and access management for agencies

Reference article · 2 min read

Identity management is the set of systems and processes that determine who can access what. It is the foundation of security, the source of most audit findings, and a frequent cause of staff frustration when done poorly.

Components

Directory. The authoritative list of users and groups, typically Active Directory, a cloud directory, or both.

Authentication. Verifying identity, increasingly with multi-factor methods.

Single sign-on. One login for many applications, through standards such as SAML and OpenID Connect.

Authorization. Roles and groups that determine access, ideally derived from job function.

Lifecycle. Creating, changing, and removing access as people join, move, and leave, ideally driven by the HR system.

Privileged access. Special handling for administrators, including separate accounts, vaulting, and session recording.

Common problems

Accounts of departed staff still active. Group sprawl nobody understands. Shared accounts. Applications with their own logins outside the directory. Administrators using their everyday accounts for privileged work. Vendors with standing access.

A modernization sequence

1. Clean the directory: disable stale accounts, document groups.
2. Enforce multi-factor authentication.
3. Integrate applications with single sign-on, starting with the most used.
4. Automate joiner, mover, and leaver processes from HR data.
5. Implement privileged access management.
6. Establish periodic access reviews by managers.

Why it matters beyond security

Onboarding a new employee in hours instead of days. Offboarding that actually removes access. Fewer passwords. Audit answers in minutes. Identity done well is a service improvement, not only a control.

Standards alignment

Multi-factor authentication and timely deprovisioning are required or expected by CJIS, HIPAA, cyber insurers, and the NIST Cybersecurity Framework. Identity work satisfies many obligations at once.