0 / 24

Model 43 of 74 · Cybersecurity

Identity & Access Management Maturity Assessment

Assess identity lifecycle, privilege governance, and access control maturity.

Pillars & areas

Identity

Manage the lifecycle

  1. 01Identity Lifecycle Management
  2. 02Privilege Governance

Authenticate

Verify the request

  1. 03Authentication Strategy
  2. 04Non-Human Identity Management

Govern

Control the access

  1. 05Access Governance & Certification
  2. 06Directory & Federation Architecture

Levels

  1. 1FragmentedManual & inconsistent
  2. 2GovernedDefined & documented
  3. 3AdaptiveContinuous & automated

01 Identity Lifecycle Management

Does the organisation reliably manage identities from creation through modification to removal?

0/4 answered

LM-1How does your organisation provision access for new joiners?

Think about whether new starters receive appropriate access on day one, or whether it takes days of ad-hoc requests.

LM-2How does your organisation handle access changes when people move roles internally?

Consider whether access from previous roles is removed when someone transfers, or whether permissions accumulate over time.

LM-3How quickly and reliably does your organisation remove access when someone leaves?

Think about whether departing staff have all access revoked on their last day, or whether accounts linger for weeks or months.

LM-4How does your organisation detect and manage orphaned or dormant accounts?

Consider whether you know how many accounts in your environment have no active owner or have not been used in months.

02 Privilege Governance

Does the organisation control elevated access with appropriate rigour and accountability?

0/4 answered

PG-1How does your organisation manage standing privileged access?

Think about whether administrators have permanent elevated access, or whether privileges are granted only when needed.

PG-2How does your organisation monitor and audit privileged account activity?

Consider whether you know what administrators are doing with their elevated access, and whether unusual activity would be detected.

PG-3How does your organisation handle emergency or break-glass access?

Think about what happens when someone needs urgent elevated access outside normal processes — is there a controlled procedure?

PG-4How does your organisation prevent privilege creep across accounts and roles?

Consider whether anyone tracks the accumulation of elevated permissions over time, and whether excess privileges are removed.

03 Authentication Strategy

Does the organisation verify identity effectively and proportionally across its environment?

0/4 answered

AS-1How broadly has your organisation deployed multi-factor authentication?

Think about whether MFA is required everywhere, only for some systems, or not at all.

AS-2How is your organisation progressing toward phishing-resistant authentication?

Consider whether you rely on SMS or app-based codes, or whether you have adopted hardware keys or passkeys that cannot be phished.

AS-3How does your organisation adapt authentication requirements to risk context?

Think about whether the same login experience applies regardless of location, device, or what the user is trying to access.

AS-4How does your organisation manage the transition away from password-based authentication?

Consider whether passwords are still the primary credential, and whether there is a strategy to reduce or eliminate reliance on them.

04 Non-Human Identity Management

Does the organisation govern service accounts, API keys, and machine identities with the same rigour as human users?

0/4 answered

NI-1Does your organisation maintain an inventory of non-human identities?

Think about whether you know how many service accounts, API keys, and machine certificates exist across your environment.

NI-2How does your organisation handle credential rotation for non-human identities?

Consider whether service account passwords and API keys are rotated regularly, or whether some have not changed in years.

NI-3How does your organisation apply least privilege to non-human identities?

Think about whether service accounts have broad admin-level access, or whether their permissions are scoped to exactly what they need.

NI-4How does your organisation manage secrets and credentials used in code and automation?

Consider whether API keys and passwords are hardcoded in scripts and configuration files, or managed through a dedicated secrets platform.

05 Access Governance & Certification

Can the organisation prove that access is appropriate and remains appropriate over time?

0/4 answered

AC-1How does your organisation conduct access reviews and certifications?

Think about whether business owners regularly verify that the access their team members hold is still needed and appropriate.

AC-2How does your organisation manage and rationalise entitlements?

Consider whether you know how many distinct access permissions exist, whether they overlap, and whether roles are well-defined.

AC-3How does your organisation enforce segregation of duties?

Think about whether anyone can both approve and execute sensitive transactions, or whether conflicting permissions are detected and prevented.

AC-4How does your organisation use access data to inform risk decisions?

Consider whether access patterns are analysed for risk signals, or whether access data sits unused in system logs.

06 Directory & Federation Architecture

Is the organisation's identity infrastructure coherent, well-governed, and capable of extending trust securely?

0/4 answered

DF-1How does your organisation manage its identity provider landscape?

Think about whether there is a single authoritative identity source, or whether multiple disconnected directories exist across the environment.

DF-2How broadly has your organisation deployed single sign-on?

Consider how many applications require separate login credentials versus how many are accessible through a single authentication event.

DF-3How does your organisation manage federation and cross-boundary trust?

Think about how identity works when collaborating with partners, customers, or across organisational boundaries.

DF-4How does your organisation ensure its identity infrastructure is resilient and well-maintained?

Consider whether your directory services are treated as critical infrastructure with appropriate redundancy, monitoring, and change management.

Self-assessment report

Identity & Access Management

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Identity & Access Management maturity model

Identity is the foundation of modern security. Every access decision, every privilege escalation, every data interaction begins with the question: who or what is requesting this, and should they be allowed? Organisations that treat identity as a side effect of IT provisioning — accounts created on request, permissions accumulated over years, service credentials hardcoded and forgotten — leave themselves exposed to the most consistently exploited attack vector in cybersecurity. Compromised credentials remain the leading cause of breaches not because the problem is unsolvable, but because most organisations have never treated identity as a discipline worth investing in.

This model is not about which identity tools you own. It is about how well identity is governed, how consistently access is controlled, and whether the organisation can answer basic questions at any moment: who has access to what, why do they have it, and is that still appropriate? It covers the full spectrum — from human users to machine identities, from day-one provisioning to the moment an account should cease to exist. The most mature organisations do not just manage identity; they use it as their primary control plane, making every access decision deliberate, auditable, and time-bound.

The Identity & Access Management maturity model assesses six areas across 24 questions, covering the complete identity landscape from human lifecycle management through to directory architecture and federation. It is designed for organisations of any size — from teams relying on spreadsheets and shared admin accounts to enterprises operating dedicated identity governance platforms. Each question describes three levels of maturity through concrete, observable behaviours rather than tool-specific capabilities.

The assessment reveals whether your organisation truly controls access or merely believes it does. It highlights gaps in provisioning speed, privilege accumulation, non-human identity sprawl, and governance rigour that traditional security assessments often overlook. Identity is the one area where a single oversight — an orphaned account, an over-privileged service credential, a stale access grant — can undo every other security investment.

Who this assessment is for

  • CISOs, identity architects, and security engineers responsible for IAM strategy and operations
  • IT directors and platform teams managing identity infrastructure and directory services
  • GRC and audit teams assessing access control effectiveness and segregation of duties
  • Cloud and DevOps teams managing service accounts, API keys, and machine identities
  • Consultants conducting identity maturity assessments or IAM transformation programmes
  • Business leaders seeking to understand the risk exposure from poor identity governance

The three maturity levels

  • Level 1 — Fragmented: Identity management is manual and inconsistent. Accounts are created on request with broad access, orphaned accounts accumulate, and there is no reliable view of who has access to what. Privileged credentials are shared, service accounts are unmanaged, and access reviews happen only when auditors demand them. The organisation cannot answer basic questions about its identity posture.
  • Level 2 — Governed: Identity processes are defined, documented, and consistently followed. Provisioning and deprovisioning follow established workflows, privileged access is individually assigned and monitored, and access reviews are conducted on a regular cycle. The organisation knows who has access to what, can demonstrate it to auditors, and has reduced its standing privilege footprint.
  • Level 3 — Adaptive: Identity is managed as a core security control. Access follows people's roles closely and is removed the moment it is no longer needed, privileged and machine access is temporary and tightly scoped, and authentication adapts to risk throughout a session. Every account and credential — human or non-human — has an owner and a purpose, access reviews are informed by real usage data, and identity analytics surface anomalies before they become incidents.

The 6 areas assessed

1. Identity Lifecycle Management

How the organisation manages the creation, modification, and removal of user identities from day one to departure. This area examines joiner-mover-leaver processes, provisioning speed, deprovisioning reliability, and whether orphaned or dormant accounts are detected and addressed. Poor lifecycle management is the root cause of most access-related risk — if you cannot reliably remove access, no other control matters.

2. Privilege Governance

How the organisation controls and monitors elevated access. This area covers privileged access management, standing versus just-in-time privileges, break-glass procedures, and whether privilege escalation is auditable and time-bound. Compromised privileged credentials provide attackers with the keys to the kingdom — this area assesses whether those keys are properly guarded.

3. Authentication Strategy

How the organisation verifies that users and devices are who they claim to be. This area examines multi-factor authentication coverage, progress toward phishing-resistant and passwordless methods, adaptive authentication policies, and whether authentication strength matches the sensitivity of what is being accessed. Weak authentication is the most common entry point for attackers.

4. Non-Human Identity Management

How the organisation manages identities that are not people — service accounts, API keys, machine certificates, bot credentials, and workload identities. This area covers inventory, ownership, credential rotation, and least-privilege enforcement for non-human identities. In most organisations, non-human identities outnumber human ones many times over, yet receive a fraction of the governance attention.

5. Access Governance & Certification

Whether the organisation can prove that access is appropriate and remains appropriate over time. This area covers access reviews, entitlement management, segregation of duties enforcement, and whether access decisions are risk-informed. Governance is the difference between an organisation that grants access and one that governs it — the former accumulates risk, the latter controls it.

6. Directory & Federation Architecture

How the organisation structures its identity infrastructure and extends trust across boundaries. This area examines identity provider strategy, single sign-on coverage, federation protocols, and multi-tenant or multi-cloud identity architecture. A fragmented directory landscape creates blind spots, inconsistent policy enforcement, and integration debt that compounds over time.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • NIST SP 800-63 (Digital Identity Guidelines) — a comprehensive framework for identity proofing, authentication, and federation assurance levels
  • ISO/IEC 24760 (IT Security — A Framework for Identity Management) — the international standard defining identity management concepts and operational frameworks
  • CISA Zero Trust Maturity Model — includes a dedicated identity pillar covering visibility, automation, and dynamic access decisions
  • Gartner Identity-First Security — an advisory framework positioning identity as the foundational control plane for modern security architecture
  • CIS Controls v8 (Controls 5 & 6) — prioritised safeguards for account management and access control management

Frequently asked questions

What is the Identity & Access Management maturity model?

Assess identity lifecycle, privilege governance, and access control maturity. It is an original, simplified model with three maturity levels (Fragmented, Governed and Adaptive), assessed through 24 questions across 6 areas: Identity Lifecycle Management, Privilege Governance, Authentication Strategy, Non-Human Identity Management, Access Governance & Certification and Directory & Federation Architecture.

How long does the Identity & Access Management assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Fragmented), 2 (Governed) or 3 (Adaptive). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.