Some legacy tools still require shared credentials, which make attribution and revocation difficult. Checks to make Document business owner and reason, restrict interactive access, store credentials in an approved vault, rotate after personnel changes, and monitor use. Set a replacement deadline and migrate toward named identities with least privilege....
Disabling a primary account is important, but it may not revoke every path into business systems. Active sessions, cloud roles, personal access tokens, shared passwords, mobile devices, and vendor portals may remain active. A reliable offboarding process maps identities to services and assigns an owner for each removal step. Coordinate the timing...
Early account creation can leave a window for unused access, while late provisioning can prevent a productive start. Checks to make Use an approved identity workflow with a start date, named manager, role-based access, MFA enrollment, and device controls. Delay activation where practical, verify access with the manager, and expire any temporary setup...
An active former employee account may retain access through a missed offboarding step, synchronized identity, or third-party application. Checks to make Confirm identity and departure status through an authorized source, disable sign-in, revoke sessions and tokens, and inspect privileged grants and recent activity. Preserve relevant audit records and...
Attackers may try credentials exposed elsewhere against business services, even when the company system itself was not breached. Checks to make Require MFA, block known compromised passwords where supported, monitor unusual sign-ins, and provide a safe credential reset path. Review session revocation and account recovery controls so a reset does not...
Cloud consoles concentrate powerful access, so weak recovery paths or broad standing permissions can increase impact. Checks to make Require strong phishing-resistant authentication where supported, use separate admin identities, limit standing roles, review break-glass access, and alert on privileged changes. Test recovery controls and keep emergency...
A device policy may report success while encryption is incomplete, suspended, or missing a recoverable key. Checks to make Use the platform’s authoritative encryption state, confirm coverage for system and removable volumes as required, verify recovery-key escrow, and check policy compliance timestamps. Test reporting on representative device types and...
Standing local administrator rights increase the impact of malicious software and accidental changes. Checks to make Inventory who has local admin rights and why, remove unnecessary standing access, and provide a controlled elevation path for approved tasks. Test common workflows first and monitor elevation events so business needs are addressed...