Access and identity management
Too many open access rights for too long is a classic risk. We structure rights, privileges and the account lifecycle to match ISO 27001.
What we see too often
Access piles up: shared accounts, former staff still active, privileges “we will see later”. The audit is not looking for an IAM product. It is looking for who is entitled to what, and who reviewed it recently.
- generic accounts, especially for administration
- no join / leave / role-change process
- passwords in a file, or no manager at all
- access reviews never done, or done “from memory”
- production, email and code repos with the same privileges
What this module is
Access management means granting the minimum needed, removing it in time, and being able to show it. ISO 27001 does not mandate a single tool; it mandates rules, reviews and evidence.
We set the process (joiner / mover / leaver), privilege rules, use of a password manager, and a review someone can actually perform. The link to secure development is on repos and secrets.
Where this sits in ISO 27001
The module covers Annex A access controls and leans on clause 5.3 roles. Classification (governance) gives the “why” of the rights.
What this module includes
- Access policy and least privilege
- Joiner, mover and leaver process
- Privileged accounts and authentication
- Periodic access review
How we work
Map critical access
Admin, email, client files, prod, repos. We start with what hurts if it leaks or stays open.
Rules and lifecycle
Who requests, who approves, how you remove. Joiners, leavers, role changes.
Passwords and privileges
Password manager, MFA where it matters, shared accounts forbidden except a written exception.
Periodic review
Calendar, owners, evidence. A review that is too heavy will not happen: we size it for an SMB.
What you receive
- Access control policy
- Joiner, mover and leaver procedure
- Rights matrix for in-scope systems
- Periodic access-review checklist
Who it is for
SMBs whose accounts pile up, who have too many administrators, or whose leavers keep access.
Who it is not for
This module is not an enterprise directory project, nor a pentest of authentications. It does not classify information for you (that is governance).
Typical duration
2 to 4 weeks, plus internal time to clean up accounts.
What you need to provide
You provide the list of critical systems, an approximate export of accounts (even imperfect), and an HR or leadership owner for joiners and leavers.
What this module does not cover
This module sets the rules and evidence. It does not configure every directory for you unless agreed separately.
Frequently asked questions
- Do we need SSO from day one?
- Useful, not mandatory. Audit wants rules, a lifecycle and reviews. SSO can come later.
- Are service accounts included?
- Yes. Forgotten technical accounts are a frequent gap. They belong in the matrix and the review.
- Who approves access?
- The asset owner or a designated lead, not IT alone. That is documented in the governance RACI.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.