Identity & Access Management

What this covers

Identity is the control plane for everything else. Who can access which system, from where, with what second factor, and how that access is revoked when someone leaves. HQT designs and implements identity platforms and integrates applications with them.

Typical activities

• Directory consolidation and hygiene, including stale accounts and group sprawl
• Single sign-on for cloud and on-premises applications using SAML and OpenID Connect
• Multi-factor authentication rollout with phishing-resistant options where appropriate
• Privileged access management for administrators and vendors
• Joiner, mover, and leaver automation tied to HR systems
• Conditional access policies based on device, location, and risk

What you receive

An identity architecture, implemented integrations, role and group designs, and operating procedures for onboarding, offboarding, and access reviews.

Why it matters

Multi-factor authentication and timely deprovisioning are among the most effective controls an agency can implement. They are also prerequisites for cyber insurance, CJIS compliance, and any Zero Trust roadmap.

Signals that identity work is due

Identity rarely announces itself, because nothing looks broken. The usual evidence that the current approach has run out:

• Offboarding depends on a supervisor emailing the help desk, and nobody can say how long a departed employee kept access
• Staff hold separate passwords for the ERP, the permitting system, and the records system, and resets fill the help desk queue
• Multi-factor authentication protects email but not the VPN, the remote desktop gateway, or the financial system
• Shared logins exist for shift work, counter terminals, or dispatch consoles, so audit logs identify a position rather than a person
• Vendor support staff hold standing administrator accounts created for an earlier go-live and never reviewed since
• Seasonal workers, elected officials, board members, and volunteers sit outside the HR system, so nothing triggers their access changes
• An insurance questionnaire or an auditor has asked for evidence of multi-factor coverage and access reviews, and it has to be assembled by hand

Any one is manageable on its own. Several at once means the process around identity, not the product, needs the work.

Where identity meets the systems you already run

Identity touches nearly every system an agency runs, so sequencing matters as much as product choice.

• Naming the HR or payroll system as the authoritative source exposes the people it was never built to track: rehires, long-term contractors, and dual-role staff such as a county employee who is also a volunteer firefighter.
• Hybrid arrangements tend to last. On-premises Active Directory keeps serving file shares, printing, and older applications while a cloud directory serves productivity tools, and policy has to match on both sides or users drift to the weaker path.
• Public safety is its own track. Access to CAD, records systems, and the state message switch falls under the FBI CJIS Security Policy, administered in each state by its CJIS Systems Agency. Its authentication requirements have tightened across revisions, so confirm what currently applies before fixing a design.
• Some applications cannot speak SAML or OpenID Connect. Utility billing and older court case management systems often keep local accounts. The options are an application proxy, credential vaulting, or a federation commitment at the next renewal, decided per application.
• Resident-facing login for permits and payments is a separate problem from workforce identity. The two share vocabulary and little else, so keep the scopes apart.

What to specify in a solicitation

Identity scopes that stay vague turn into change orders. Terms worth writing down:

• An application inventory as an early deliverable: each system, its current authentication method, its business owner, and whether it supports SAML 2.0, OpenID Connect, or SCIM provisioning
• A named list of the applications this phase integrates, and those deferred
• The authoritative source of identity, and the rule for populations the HR system does not carry
• Which roles require phishing-resistant authenticators such as FIDO2 security keys or smart cards. NIST digital identity guidance treats one-time codes sent by text message as a weaker option.
• Break-glass accounts: where the credentials are held, and how their use is alerted on and reviewed
• Deprovisioning as a target interval from HR event to account disablement, with logging able to evidence it
• Identity licensing and hardware authenticators quoted separately from labor, since conditional access, governance, and privileged access features often sit in higher subscription tiers

Measuring the result

Baseline these before work starts, then measure at close-out and again after a few quarters of steady operation:

• Share of in-scope applications authenticating through the identity provider, with the remaining local-password systems named
• Elapsed time from an HR separation to the last account disabled, sampled from actual separations rather than quoted from policy
• Accounts holding standing administrative rights, and how many of those belong to vendors or contractors
• Multi-factor coverage counted separately for email, remote access, and privileged accounts, since one agency-wide figure hides gaps
• Access reviews measured by access actually removed, not by review notices sent

The same figures show failure: an implementation that stops after the easy cloud applications leaves the local-password list untouched, and one that automates account creation but not removal leaves the separation interval unchanged.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions